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1. Policy Directive Title. 

(U) Domestic Investigations and Operations Guide 

2. Publication Date. 

2013-10-16 

3. Effective Date. 

2013-10-16 

4. Review Date. 

2016-10-16 

5. Primary Strategic Objective, 

A3-Preserve dvil liberties. 


6. Authorities: 

I 

6.1. (U) Attorney General's Guidelines for Domestic FBI Operations (AGG-Dom), dated September 29, 
2008 

6.2. (U) See Federal Bureau of Investigation (FBI) Domestic Investigations and Operations Guide, Section 
A. 


7. Purpose: 

(U) The purpose of this policy is to promulgate the FBI Domestic Investigations and Operations Guide. 


8. Policy Statement: 

8.1. (U) All FBI employees responsible for performing domestic investigative operations and intelligence 
collection activities in furtherance of the mission of the FBI shall comply with the policies and procedures 
contained in the FBI Domestic Investigations and Operations Guide (DIOG), which is consistent with the 
laws, rules, and regulations governing FBI investigations, operations, programs, and activities. 

8.2. (U) All FBI employees responsible for performing or supporting domestic investigative operations and 
intelligence collection activities in furtherance of the mission of the FBI shall successfully complete all 
assigned training courses derived from the AGG-Dom and the DIOG. 

8.3. (U) All updates and modifications to the DIOG shall be coordinated by the Corporate Policy Office, 
Resource Planning Office, and approved internally by the deputy director. Furthermore, updates and 
modifications to the following sections of the DIOG require Attorney General approval: 

8.3.1. (U) Undisclosed Participation, Section 16 

8.3.2, (U) Classified Appendix 

8.4. (U) Unless otherwise specifically stated in the AGG-Dom, DIOG or FBI policy, division heads may 
deleqate, as appropriate, approval authorities for authorized investiqative operations, intelliqence 
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collection activities and methods as described in the DIOG. 

9. Scope: 

(U) The AGG-Dom and DIOG apply, to, all FBI domestic investigations and operations conducted by FBI 
employees such as, but not limitedto, applicable professional staff, intelligence analysts, special agents, 
task force officers, detailees, FBI contractors and confidential human sources (CHS). All of these. "FBI 
employees'’ are bound by the AGG-Dom and DIOG. In the DIOG, the use of “FBI employee" implies the 
use of all personnel descriptions, if not otherwise prohibited by law or policy. See DIOG Section 1.1 for 
additional details. 

10. Proponent:. 

(U) Director's Office, Resource Planning Office, Corporate Policy Office 

11. Roles and Responsibilities: 

11.1. (U) The deputy director must: 

11.1.1. (U) Ensure FBI compliance with the DIOG and subordinate implementing procedural directives and 
division specific policy implementation guides. 

11.1.2. (U) Ensure the development and delivery of necessary training and the execution of the 
monitoring and auditing processes. 

t 

11.1.3. (U) Approve all updates to the DIOG upon coordination through the FBI policy cycle. 

11.1.4. (U) Ensure that the DIOG is updated as necessary to comply with changes in the law, rules, or 
regulations, but np later than one year from the initial effective date of the DIOG, and every three, years; 
thereafter. 

11.1.5. (U) Coordinate Attorney General approval of updates to the following DIOG sections: 

11.1.5.1. (U) Undisclosed Participation, Section 16. 

11.1.5.2. (U) Classified Appendix. 

11.2. (U) FBIHQ assistant directors (AD) and operational program managers must: 

11.2.1. (U) Promulgate and update, as necessary, a policy implementation guide which supplements the; 
DIOG. The program implementation guide cannot be less restrictive than the DIOG- The policy 
implementation guide must. comply with the policy contained in the. DIOG, unless approval for deviation 
from the DIOG is reviewed by the General Counsel and approved by the FBI deputy director. The policy 
implementation guide, and any updates thereto, must be approved by the executive assistant director 
having oversight, over the program upon coordination through the FBI policy cycle. 

11.2.2. (U) Submit, ini consultation with the. Office of General Counsel, update requests to the policies and 
procedures; contained in the DIOG to the Corporate Policy Office for coordination. 

11.2.3. (U) Develop, in consultation with the Office of Integrity and Compliance, monitoring mechanisms 
to ensure employee compliance, with the policy and procedures contained in the DIOG. 

iii 
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11.3. (U) FBI employees must: 

11.3.1. (U) Ensure that all investigative activities they conduct comply with the Constitution, federal law, 
executive orders. Presidential directives, AGG*Dom, other Attorney General guidelines, treaties, 
memoranda of agreement/understanding, and any other applicable legal and policy requirements. 

11.3.2. (U) Consult with his or her supervisor and chief division counsel or Office of General Counsel when 
unsure of the legality of any investigative action or intelligence collection activity. 

11.3.3. (U) Ensure that all investigative activities they conduct comply with the policies and procedures 
contained in the DIOG. 

11.3.4. (U) Ensure that civil liberties and privacy are protected throughout the assessment or 
investigative process. 

11.3.5. (U) Complete/ timely and successfully, all assigned training Courses derived from the policies and 
procedures contained in the DIOG. 

11.4. (U) Supervisors must: 

11.4.1. (U) Monitor employee compliance with the Constitution, federal law, executive orders, Presidential 
directives, AGG-Dom, other Attorney General guidelines, treaties, memoranda of 
agreement/understanding, the policies and procedures Contained in the DIOG, and any other applicable 
legal and policy requirements. 

11.4.2. (U) Ensure their employees implement the policies and procedures contained in the DIOG. 

11.4.3. (U) Ensure the standards defined in the DIOG are satisfied upon approval or review of any 
investigative or collection activity. 

11.4.4. (U) Report, if encountering a practice that does not comply with the law, rules, or regulations, 
that Compliance concern to the proper authority and, when necessary, take action to maintain compliance. 

11.4.5. (U) Not retaliate or take adverse action against persons who raise compliance concerns. 

11.4.6. (U) Assign promptly DIOG training courses to their employees and ensure their employees timely 
and successfully Complete the assigned training courses. 

11.5. (U) The Corporate Policy Office (CPO) must: 

11.5.1. (U) Maintain the most current version of the DIOG on its Web site, coordinate modification 
requests to the DIOG, and update the DIOG as such requests are approved. 

11.5.2. (U) Coordinate the development of DIOG training courses with the FBI operational programs and 
the Training Division and set employee course completion deadlines. CPO must monitor compliance with 
this mandate through FBIHQ and field office training Coordinators. 

11.5.3. (U) Develop and maintain a centralized portal for employee feedback of the policies and 
procedures contained in the DIOG. 

11.5.4. (U) Report any identified compliance risk areas associated with the DIOG to the Office of Integrity 

and Compliance. 

iv 
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11.6. (U) FBIHQ and field office training coordinators must:- 

11.6.1. (U) Monitor timely and successful completion of DIOG training courses for all employees in their 
respective FBIHQ and field office.. 

11.6.2. (U) Provide training tracking information to the CPO on a regular basis to be determined by the 
CPO. 

11.7. (U) The. General Counsel must.:- 

11.7.1. (U) Ensure the DIOG is in compliance; with the AGG-Dom and all applicable legal authorities 
governing FBI investigations/ operations/ programs, and activities. 

11.7.2. (U) Review all requested modifications to the policies and procedures contained in the DIOG. 

11.8. (U) The Inspection Division must: 

11.8.1. (U) Conduct inspection audit and monitoring protocols consistent with ensuring the AGG-DOm and 
DIOG are appropriately utilized by FBI employees. 

11.9. (U) The. Office of Integrity and Compliance; must; 

11.9.1. (U) Review all requested modifications to the policies and procedures contained in the DIOG to 
ensure that these are dearly stated and that there, is adequate training and monitoring to promote 
compliance with the modification. 

11.9.2. (U) Fadlitate, in coordination with FBIHQ ADs and operational program managers, the. 
development of monitoring mechanisms to ensure, employee; compliance with the policy and procedures; 
contained in the DIOG. 

(U) For additional detailed roles and responsibilities assodated with the laws, rules and regulations, 
induding the policies and procedures contained within the DIOG, governing FBI investigations, operations, 
programs and activities, see Section 3 of the DIOG. 

12. Exemptions: 

(U) See Domestic Investigations Operations Guide, Section 2, paragraphs 2.6, 2.7, and 2.9. 

13. Supersession;. 

13.1. (U) 0460D and 0460PG, Domestic Investigations and Operations Guide 

13.2. (U) See Domestic Investigations Operations Guide, Appendix R. 

14. References, Key Words, and Links; 

(U) See Domestic Investigations Operations Guide, Appendices A, 6, and P. 

15. Definitions: 

(U) See Domestic Investigations Operations Guide, Appendix Q. 
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16. Appendices/ Attachments, and Forms: 

(U) FBI Domestic Investigations and Operations Guide 

'• . ' 'Sponsoring Executive Approval ~ X..-k •; -f’4 

Namei 

1 

Title: 

Unit Chief, Corporate Policy Office 

~ Stakeholder Executive Approval v * V" . I 

Name: 

Patrick W.Keliev 

Title: 

Assistant Director, Office of Integrity and Compliance 

1 - : ':\ v : ~ Stakeholder Executive Approvari /?,,5 .//<^5rji I 

Name: 

Andrew Weissmann 

Title: 

The General Counsel 

; _ * aV ' (Stakeholder Executive Approvals ^ V. ;1 | 

Name: 

Kevin L. Perkins 

Title: 

Associate Deputy Director 
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Title: 

Deputy Director 
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Notice of Supersession and Update: 

This document amends and supersedes the previous Domestic Investigations and Operations 

Guide (DIOG), published October 15, 2011 

Updated pages are denoted with “Version Dated: June 15, 2012,” “Version Dated: 

November 19, 2012,” or 
“Version Dated: October 16, 2013” 


Contact Information: 

Questions or comments pertaining to the DIOG can be directed to: 
The Resource Planning Office (RPO), Corporate Policy Office (CPO) at 
HQ_DIVOO_CORPORATE_POLICY_OFHCE 
or the Office of the General Counsel (OGC) 


Privileged Information: 

Any use of this document, including direct quotes or identifiable paraphrasing, will be 

marked with the following statement: 

This is a privileged document that cannot be released in whole or in part to persons or 
agencies outside the Federal Bureau of Investigation, nor can it be republished in whole 
or in part in any written form not containing this statement, including general use 
pamphlets, without the approval of the Director of the Federal Bureau of Investigation. 
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(U) PREAMBLE 


August .17, 2011 

(U) As the primary investigative agency of the federal government, the FBI has the authority and 
responsibility to investigate all violations of federal law that are not exclusively assigned to 
another federal agency. The FBI is further vested by law and by Presidential directives with the 
primary role in carrying out criminal investigations and investigations of threats to the national 
security of the United States. This includes the lead domestic role in investigating international 
terrorist threats to the United States, and in conducting counterintelligence activities to counter 
foreign entities’ espionage and intelligence efforts directed against the United States. The FBI is 
also vested with important functions in collecting foreign intelligence as a member agency of the 
United States Intelligence Community (USIC). (AGG-Dom, Introduction) 

(U) While investigating crime, terrorism, and threats to the national security, and collecting 
foreign intelligence, the FBI must fully comply with all laws and regulations, including those 
designed to protect civil liberties and privacy. Through compliance, the FBI will continue to earn 
the support, confidence and respect of the people of the United States. 

(U) To assist the FBI in its mission, the Attorney General signed the Attorney General ’s 
Guidelines. fQL Domestic FBI_ Operations (AGG-Dom) on September 29, 2008. The primary 
purpose of the AGG-Dom and the Domestic Investigations and Operations Guide (DIOG) is to 
standardize policy so that criminal, national security, and foreign intelligence investigative 
activities are accomplished in a consistent manner, whenever possible (e.g., same approval, 
notification, and reporting requirements). In addition to the DIOG, each FBIHQ operational 
division has a policy implementation guide (PG) that supplements this document. Numerous FBI 
manuals, electronic communications, letterhead memoranda, and other policy documents are 
incorporated into the DIOG and the operational division policy implementation guides, thus, 
consolidating the FBI’s policy guidance. The FBIHQ Corporate Policy Office (CPO) plays an 
instrumental role in this endeavor. Specifically, the CPO maintains the most current version of 
the DIOG on its website. As federal statutes, executive orders, Attorney General guidelines, FBI 
policies, or other relevant authorities change, CPO will electronically update the DIOG after 
appropriate coordination and required approvals. 

(U) This revised DIOG is a direct result of more than 700 comments received from field and 
Headquarters employees after release of the initial DIOG in December 2008. Each suggestion 
was reviewed by a working group comprised of experienced field agents and Chief Division 
Counsels, as well as representatives from the CPO, the Office of the General Counsel (OGC), 
and the Office of Integrity and Compliance (OIC). Many of these changes and suggestions have 
been incorporated in the revised DIOG. These changes to the DIOG should better equip you to 
protect the people of the United States against crime and threats to the national security and to 
collect foreign intelligence. This is your document, and it requires your input so that we can 
provide the best service to our nation. If you discover a need for change, please forward your 
suggestion to FBIHQ CPO. 

(U) Thank you for your outstanding service! 

Robert S. Mueller, III 

Director 
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1 (U) SCOPE AND PURPOSE 


1.1 (U) Scope 

(U) The Domestic Investigations and Operations Guide (DIOG) applies to all investigative 
activities and intelligence collection activities conducted by the FBI within the United States, in 
the United States territories, or outside the territories of all countries. This policy document does 
not apply to investigative and intelligence collection activities of the FBI in foreign countries; 
those are governed by: 

A) (U) The Attorney General ’s Guidelines for Extraterritorial FBI Operations and Criminal 

Investigations; 

B) (U) The Attorney General’s Guidelines for FBI National Security Investigations and Foreign 
Intelligence Collection (those portions which were not superseded by The Attorney General 
Guidelines for Domestic FBI Operations ); 

C) (U) The Attorney General Guidelines on the Development and Operation of FBI Criminal 
Informants and Cooperative Witnesses in Extraterritorial Jurisdictions; 

D) (U) The Attorney General Procedure for Reporting and Use of Information Concerning 
Violations of Law and Authorization for Participation in Otherwise Illegal Activity in FBI 
Foreign Intelligence, Counterintelligence or International Terrorism Intelligence 
Investigations (August 8, 1988; and 

E) (U) Memorandum of Understanding Concerning Overseas and Domestic Activities of the 
Central Intelligence Agency and the Federal Bureau of Investigation (2005). 

(U//FOUO) Collectively, these guidelines and procedures are hereinafter referred to as the 
Extraterritorial Guidelines in the DIOG. 

1.2 (U) Purpose 

(U) The purpose of the DIOG is to standardize policies so that criminal, national security, and 
foreign intelligence investigative activities are consistently and uniformly accomplished 
whenever possible (e.g., same approval, opening/closing, notification, and reporting 
requirements). 

(U) This policy document also stresses the importance of oversight and self-regulation to ensure 
that all investigative and intelligence collection activities are conducted within Constitutional 
and statutory parameters and that civil liberties and privacy are protected. 

(U) In addition to this policy document, each FBI Headquarters (FBIHQ) operational division 
has a Policy Implementation Guide (PG) or several PGs that supplement the DIOG. No policy or 
PG may contradict, alter, or otherwise modify the standards of the DIOG. Requests for DIOG 
modifications can be made to the Corporate Policy office (CPO) pursuant to DIOG Section 3.2.2 
paragraphs (A), (B), (C) and (D). As a result, numerous FBI manuals, electronic 
communications, letterhead memoranda, and other policy documents are incorporated into the 
DIOG and operational division PGs, thus, consolidating FBI policy guidance. 
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2 (U) GENERAL AUTHORITIES AND PRINCIPLES 


2.1 (U) Authority of the Attorney General’s Guidelines for Domestic FBI 

Operations 

(U) The Attorney General ’s Guidelines for Domestic FBI Operations (AGG-Dom) apply to 
investigative arid intelligence collection activities conducted by the FBI within the United States, 
in the United States territories, or outside the territories of all countries. They do not apply to 
investigative and intelligence collection activities of the FBI in foreign countries, which are 
governed by the Extraterritorial Guidelines discussed in DIOG Section 13. (Reference: AGG- 
Dom, Part I.A.) 

(U) The AGG-Dom replaces the following six guidelines: 

A) (U) The Attorney General 's Guidelines on General Crimes, Racketeering Enterprise and 
Terrorism Enterprise Investigations (May 30, 2002); 

B) (U) The Attorney General 's Guidelines for FBI National Security Investigations and Foreign 
Intelligence Collection (October 31, 2003); 

C) (U) The Attorney General’s Supplemental Guidelines for Collection, Retention, and 
Dissemination of Foreign Intelligence (November 29, 2006); 

D) (U) The Attorney General Procedure for Reporting and Use of Information Concerning 
Violations of Law and Authorization for Participation in Otherwise Illegal Activity in FBI 
Foreign Intelligence, Counterintelligence or International Terrorism Intelligence 
Investigations (August 8, 1988); 

E) (U) The Attorney General’s Guidelines for Reporting on Civil Disorders and Demonstrations 
Involving a Federal Interest (April 5, 1976); and 

F) (U) The Attorney General ’s Procedures for Lawful, Warrantless Monitoring of Verbal 
Communications (May 30, 2002) [only portion applicable to FBI repealed] . 

(U) Certain of the existing guidelines that are repealed by the AGG-Dom currently apply in part 
■to extraterritorial operations, including the Attorney General’s Guidelines for FBI National 
Security Investigations and Foreign Intelligence Collection, and the Attorney General Procedure 
for Reporting and Use of Information Concerning Violations of Law and Authorization for 
Participation in Otherwise Illegal Activity in FBI Foreign Intelligence, Counterintelligence or 
International Terrorism Intelligence Investigations. To ensure that there is no gap in the 
existence of guidelines for extraterritorial operations, these existing guidelines will remain in 
effect in their application to extraterritorial operations notwithstanding the general repeal of these 
existing guidelines by the AGG-Dom. 

(U) Also, the classified Attorney General Guidelines for Extraterritorial FBI Operation and 
Criminal Investigations (1993) will continue to apply to FBI criminal investigations, pending the 
execution of the new guidelines for extraterritorial operations. Finally, for national security and 
foreign intelligence investigations, FBI investigative activities will continue to be processed as 
set forth in the classified Memorandum of Understanding Concerning Overseas qnd_ Domestic 
Activities of the Central Intelligence Agency and_ the Federal Bureau of Investigation (2005). 
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2.2 (U) General FBI Authorities under AGG-Dom 

(U) The AGG-Dom recognizes four broad, general FBI authorities. (AGG-Dom, Part I.B.) 

2.2.1 (U) Conduct Investigations and Collect Intelligence and Evidence 

(U) The FBI is authorized to collect intelligence and to conduct investigations to detect, obtain 
information about, and prevent and protect against federal crimes and threats to the national 
security and to collect foreign intelligence, as provided in the DIOG (AGG-Dom, Part II). 

(U) By regulation, the Attorney General has directed the FBI to investigate violations of the laws 
of the United States and to collect evidence in investigations in which the United States is or may 
be a party in interest, except in investigations in which such responsibility is by statute or 
otherwise specifically assigned to another investigative agency. The FBI’s authority to 
investigate and to collect evidence involving criminal drug laws of the United States is 
concurrent with such authority of the Drug Enforcement Administration (DEA) (28 C.F.R. § 

0.85 [a]). 


2.2.2 (U) Provide Investiga tive Assistance 

(U) The FBI is authorized to provide investigative assistance to other federal, state, local, or 
tribal agencies, and foreign agencies as provided in Section 12 of the DIOG (AGG-Dom, Part 
III). 


2.2.3 (U) Conduct Intelligence Analysis and Planning 

(U) The FBI is authorized to conduct intelligence analysis and planning as provided in Section 
1 5 of the DIOG (AGG-Dom, Part IV). 

2.2.4 (U) Retain and Share Information 

(U) The FBI is authorized to retain and to share information obtained pursuant to the AGG-Dom, 
as provided in Sections 12 and 14 of the DIOG (AGG-Dom, Part VI). 

2.3 (U) FBI as an Intelligence Agency 

(U) The FBI is an intelligence agency as well as a law enforcement agency. Its basic functions 
accordingly extend beyond limited investigations of discrete matters, and include broader 
analytic and planning functions. The FBI’s responsibilities in this area derive from various 
administrative and statutory sources. See Executive Order 12333; 28 U.S.C. § 532 note 
(incorporating P.L. 108-458 §§ 2001-2003) and 534 note (incorporating P.L. 109-162 § 1107). 

(U) Part IV of the AGG-Dom authorizes the FBI to engage in intelligence analysis and planning, 
drawing on all lawful sources of information. The functions authorized under that Part includes: 
(i) development of overviews and analyses concerning threats to and vulnerabilities of the United 
States and its interests; (ii) research and analysis to produce reports and assessments (see note 
below) concerning matters relevant to investigative activities or other authorized FBI activities; 
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and (iii) the operation of intelligence systems that facilitate and support investigations through 
the compilation and analysis of data and information on an ongoing basis. 

(U) Note : In the DIOG, the word “assessment” has two distinct meanings. The AGG-Dom 
authorizes as an investigative activity an “Assessment,” which requires an authorized purpose 
and clearly defined objective (s) as discussed in the DIOG Section 5. The United States 
Intelligence Community (USIC), however, also uses the word “assessment” to describe written 
intelligence products as discussed in the DIOG Section 15.6.1.2. 

2.4 (U) FBI Lead Investigative Authorities 

2.4.1 (U) Introduction 

(U//FOUO) The FBI’s primary investigative authority is derived from the authority of the 
Attorney General as provided in 28 U.S.C. §§ 509, 510, 533 and 534. Within this authority, the 
Attorney General may appoint officials to detect crimes against the United States and to conduct 
such other investigations regarding official matters under the control of the Department of 
Justice (DOJ) and the Department of State (DOS) as may be directed by the Attorney General 
(28 U.S.C. § 533). The Attorney General has delegated a number of his statutory authorities and 
granted other authorities to the Director of the FBI (28 C.F.R. § 0.85 [a]). Some of these 
authorities apply both inside and outside the United States. 

2.4.2 (U) Terrorism and Counterterrorism Investigations 

(U) The Attorney General has directed the FBI to exercise Lead Agency responsibility in 
investigating all crimes for which DOJ has primary or concurrent jurisdiction and which involve 
terrorist activities or acts in preparation of terrorist activities within the statutory jurisdiction of 
the United States. Within the United States, this includes the collection, coordination, analysis, 
management and dissemination of intelligence and criminal information, as appropriate. If 
another federal agency identifies an individual who is engaged in terrorist activities or acts in 
preparation of terrorist activities, the other agency is required to promptly notify the FBI. 
Terrorism, in this context, includes the unlawful use of force and violence against persons or 
property to intimidate or coerce a government, the civilian population, or any segment thereof, to 
further political or social objectives (28 C.F.R. § 0.85[I]). For a current list of legal authorities 
relating to the FB I’s investigative jurisdiction in terrorism investigations, see the O GC Law 
Library website at 

(U//FOUO) DOJ guidance designates the FBI as Lead Agency for investigating explosives 
matters which, under the following protocol, demonstrate a possible nexus to international or 
domestic terrorism: 

A) (U//FOUO) The following factors are strong indicia of a nexus to terrorism and lead-agency 
jurisdiction is assigned based on these factors alone: 

1) (U//FOUO) an attack on a government building, mass transit, a power plant; or 

2) (U//FOUO) the use of a chemical, biological, radiological, or nuclear agents. 


2-3 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 


Version Dated: 
October 15, 2011 



§2 


UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 


B) (U//FOUO) Requires each agency to notify the other immediately when responding to an 
explosives incident and to share all relevant information that may serve to ride in or out a 
connection to terrorism; and 


C) (U//FOUO) Creates a process for the FBI/ Joint Terrorism Task Force (JTTF) to identify an 
explosives incident as connected to terrorism when there is reliable evidence supporting that 
claim and establishes a process for shifting lead-agency jurisdiction to the JTTF until the 
issue is resolved. (See DOJ Memorandum, dated August 3, 2010 , on “Protocol for Assigning 


Lead Agency Jurisdiction in Explosives Investigations. ’) 


2.4.2. 1 (U) "Federal Crimes of Terrorism" 


(U) Pursuant to the delegation in 28 C.F.R. § 0.85(1), the FBI exercises the Attorney 
General’s lead investigative responsibility under 18 U.S.C. § 2332b(f) for all “federal crimes 
of terrorism” as identified in that statute. Many of these statutes grant the FBI extraterritorial 
investigative responsibility (See the cited statute for the full particulars concerning elements 
of the offense, jurisdiction, etc.). Under 18 U.S.C. § 2332b(g)(5), the term "federal crime of 
terrorism" means an offense that is: (i) calculated to influence or affect the conduct of 
government by intimidation or coercion or to retaliate against government conduct; and (ii) 
violates a federal statute relating to: 


A) (U) Destruction of aircraft or aircraft facilities (18 U.S.C. § 32); 

B) (U) Violence at international airports (applies to offenses occurring outside the United States 
in certain situations) (18 U.S.C. § 37); 

C) (U) Arson within “ special maritime and territorial jurisdiction (SMTJ) of the United States ” 
(SMTJ is defined in 18 US. C. §7) (18 US. C. § 81); 

D) (U) Prohibitions with respect to biological weapons (extraterritorial federal jurisdiction if 
offense committed by or against a United States national) (18 U.S.C. § 175); 

E) (U) Possession of biological agents or toxins by restricted persons (18 U.S.C. § 175b); 

F) (U) Variola virus (includes smallpox and other derivatives of the variola major virus) (applies 
to offenses occurring outside the United States in certain situations) (18 U.S.C. § 175c); 

G) (U) Prohibited activities regarding chemical weapons (applies to offenses occurring outside 
the United States in certain situations) (18 U.S.C. § 229) (E.O. 13128 directs any possible 
violation of this statute be referred to the FBI); 

H) (U) Congressional, Cabinet, and Supreme Court assassination, kidnapping and assault (18 
U.S.C. § 351[a]-[dj) (18 U.S.C. § 351 [gj directs that the FBI shall investigate violations of 
this statute); 

I) (U) Prohibited transactions involving nuclear materials (applies to offenses occurring outside 
the United States in certain situations) (18 U.S.C. § 831); 

J) (U) Participation in nuclear and weapons of mass destruction threats to the United States 
(extraterritorial federal jurisdiction) (18 U.S.C. § 832); 

K) (U) Importation, exportation, shipping, transport, transfer, receipt, or possession of plastic 
explosives that do not contain a detection agent (18 U.S.C. § 842 [m] and [n]); 

L) (U) Arson or bombing of government property risking or causing death (1 8 US. C. § 844 [f] [2] 
or [3]) (18 U.S.C. § 846[a] grants FBI and the Bureau of Alcohol, Tobacco, Firearms, and 
Explosives (ATF) concurrent authority to investigate violations of this statute). See Section 
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2.4.2.1.L above regarding DO J Memorandum dated 08/03/2010 on ATF/FBI Lead Agency 
Jurisdiction ; 

M) (U) Arson or bombing of property used in or affecting interstate or foreign commerce (18 
U.S.C. § 844[i]) (18 U.S.C. § 846[a] grants FBIandATF concurrent authority to investigate 
violations of this statute); 

N) (U) Killing or attempted killing during an attack on a federal facility with a dangerous 
weapon (18 U.S.C § 930 [c]); 

O) (U) Conspiracy within United States jurisdiction to murder , kidnap , or maim persons at any 
place outside the United States (18 U.S.C. § 956 [a] [1]); 

P) (U) Using a computer for unauthorized access, transmission , or retention of protected 
information (18 U.S.C. § 1030[a][l]) (18 U.S.C. § 1030[d] [2] grants the FBI “primary 
authority ” to investigate Section 1030[a][l] offenses involving espionage, foreign 
counterintelligence, information protected against unauthorized disclosure for reasons of 
national defense or foreign relations, or Restricted Data as defined in the Atomic Energy Act, 
except for offenses affecting United States Secret Service (USSS) duties under 18 U.S.C. § 
3056[a]); 

Q) (U) Knowingly transmitting a program, information, code, or command and thereby 
intentionally causing damage, without authorization, to a protected computer (18 U.S.C. § 

1 030 [a] [5] [A] [i]); 

R) (U) Killing or attempted killing of officers or employees of the United States, including any 
member of the uniformed services (18 U.S.C. § 1114); 

S) (U) Murder or manslaughter of foreign officials, official guests, or internationally protected 
persons (applies to offenses occurring outside the United States in certain situations) (18 
U.S.C. § 1116) (Attorney General may request military assistance in the course of 
enforcement of this section); 

T) (U) Hostage taking (applies to offenses occurring outside the United States in certain 
situations) (18 U.S.C. § 1203); 

U) (U) Willfully injuring or committing any depredation against government property or 
contracts (18 U.S. C. § 1361); 

V) (U) Destruction of communication lines, stations, or systems (18 U.S.C. § 1362); 

W) (U) Destruction or injury to buildings or property within special maritime and territorial 
jurisdiction of the United States (18 U.S.C. § 1363); 

X) (U) Destruction of $100,000 or more of an “energy facility” property as defined in the statute 
(18 U.S.C. §1366); 

Y) (U) Presidential and Presidential staff assassination, kidnapping, and assault (18 U.S.C. § 
1751 [a], [bj, [c], or [d]) (extraterritorial jurisdiction) (Per 18 U.S.C. § 1751[i], 1751 
violations must be investigated by the FBI; FBI may request assistance from any federal 
[including military], state, or local agency notwithstanding any statute, rule, or regulation to 
the contrary); 

Z) (U) Terrorist attacks and other violence against railroad carriers and against mass 
transportation systems on land, on water, or through the air (includes a school bus, charter, 
or sightseeing transportation; or any means of transport on land, water, or through the air) 
(18 U.S.C. §1992); 

AA) (U) Destruction of national defense materials, premises, or utilities (18 U.S.C. § 2155); 
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BE) (U) Production of defective national defense materials , premises, or utilities (18 U.S.C. § 

2156); 

CC) (U) Violence against maritime navigation (18 U.S.C. § 2280); 

DD) (U) Violence against maritime fixed platforms (located on the continental shelf of the 

United States or located internationally in certain situations) (18 U.S.C. § 2281); 

EE) (U) Certain homicides and other violence against United States nationals occurring 
outside of the United States (18 U.S.C. § 2332); 

FF) (U) Use of weapons of mass destruction (WMD) (against a national of the United States 
while outside the United States; against certain persons or property within the United States; 
or by a national of the United States outside the United States) (18 U.S.C. § 2332a) (WMD 
defined in 18 U.S.C. § 2 332a[c][2J); 

GG) (U) Acts of terrorism transcending national boundaries (includes murder, kidnapping, 

and other prohibited acts occurring inside and outside the United States under specified 
circumstances — including that the victim is a member of a uniform service; includes offenses 
committed in the United States territorial sea and airspace above and seabed below; includes 
offenses committed in special maritime and territorial jurisdiction of the United States as 
defined in 18 U.S.C. § 7) (18 U.S.C. § 2332b); 

HH) (U) Bombings of places of public use, government facilities, public transportation 

systems and infrastructure facilities (applies to offenses occurring inside or outside the United 
States in certain situations; does not apply to activities of armed forces during an armed 
conflict) (18 U.S.C. §2332fi; 

II) (U) Missile systems designed to destroy aircraft (applies to offenses occurring outside the 
United States in certain situations) (18 U.S.C. § 2332g); 

JJ) (U) Radiological dispersal devices (applies to offenses occurring outside the United States in 
certain situations) (18 U.S.C. § 2332h); 

KK) (U) Harboring or concealing terrorists (1 8 U.S.C. § 2339); 

LL) (U) Providing material support or resources to terrorists (18 U.S.C. § 2339 A); 

MM) (U) Providing material support or resources to designated foreign terrorist organizations 

(extraterritorial federal jurisdiction) (18 U.S.C. § 2339B) (“. The Attorney General shall 
conduct any investigation of a possible violation of this section, or of any license, order, or 
regulation issued pursuant to this section. ” 18 U.S.C. § 2339B[e][lj); 

NN) (U) Prohibitions against the financing of terrorism (applies to offenses occurring outside 
the United States in certain situations including on board a vessel flying the flag of the United 
States or an aircraft registered under the laws of the United States) (18 U.S.C. § 2339C) 
(Memorandum of Agreement between the Attorney General and the Secretary of Homeland 
Security, dated May 13, 2005: FBI leads all terrorist financing investigations and operations); 

00) (U) Relating to military-type training from a foreign terrorist organization 

(extraterritorial jurisdiction) (18 U.S.C. § 2339D); 

PP) (U) Torture applies only to torture committed outside the United States in certain 
situations; torture is defined in 18 U.S.C. § 2340 (18 U.S.C. § 2340A); 

00) (U) Prohibitions governing atomic weapons (applies to offenses occurring outside the 

United States in certain situations) (42 U.S. C. § 2122) (FBI shall investigate alleged or 
suspected violations per 42 U.S.C. § 2271 [b]); 
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RR) (U) Sabotage of nuclear facilities or fuel (42 U.S.C. § 2284) (FBI shall investigate 
alleged or suspected violations per 42 U.S.C. § 2271 [b]); 

SS) (U) Aircraft piracy (applies to offenses occurring outside the United States in certain 
situations) (49 US.C. § 46502) (FBI shall investigate per 28 U.S.C. § 538); 

TT) (U) Assault on a flight crew with a dangerous weapon (applies to offenses occurring in 
the “special aircraft jurisdiction of the United States ” as defined in 49 U.S.C. § 46501 [2]); 
(second sentence of 49 U.S.C. § 46504) (FBI shall investigate per 28 U.S.C. § 538); 

UU) (U) Placement of an explosive or incendiary device on an aircraft (49 U.S.C. § 

46505[b][3]) (FBI shall investigate per 28 U.S.C. § 538); 

W) (U) Endangerment of human life on aircraft by means of weapons (49 US. C. § 46505 [c]) 
(FBI shall investigate per 28 U.S.C. § 538); 

WW) (U) Application of certain criminal laws to acts on aircraft (if homicide or attempted 
homicide is involved) (applies to offenses occurring in the “special aircraft jurisdiction of the 
United States" as defined in 18 U.S.C. § 46501 [2] ); (49 U.S.C. § 46506) (FBI shall 
investigate per 28 U.S.C. § 538); 

XX) (U) Damage or destruction of interstate gas or hazardous liquid pipeline facility (49 
U.S.C. § 60123 [b]); and 

YY) (U) Section 1010 A of the Controlled Substances Import and Export Act (relating to 

narco-terrorism). 

2 .4.2.2 (U) Additional offenses not defined as "Federal Crimes of Terrorism" 

(U) Title 18 U.S.C. § 2332b(f) expressly grants the Attorney General primary investigative 
authority for additional offenses not defined as “Federal Crimes of Terrorism.” These offenses 
are: 


A) (U) Congressional ', Cabinet, and Supreme Court assaults (18 U.S.C. § 351 [e]) (18 U.S.C. § 
351 [gj) directs that the FBI investigate violations of this statute); 

B) (U) Using mail, telephone , telegraph, or other instrument of interstate or foreign commerce to 
threaten to kill, injure, or intimidate any individual or unlawfully to damage or destroy any 
building, vehicle, or other real or personal property by means of fire or explosive (18 U.S.C. § 
844[ej); (18 U.S.C. § 846[a] grants FBIandATF concurrent authority to investigate 
violations of this statute); 

C) (U) Damages or destroys by means of fire or explosive any building, vehicle, or other 
personal or real property, possessed, owned, or leased to the United States or any agency 
thereof or any institution receiving federal financial assistance (18 U.S.C. § 844[j][l]) (18 
U.S.C. § 846 [a] grants FBIandATF concurrent authority to investigate violations of this 
statute). See Section 2.4.2.1.L above regarding DOJ Memorandum dated 08/03/2010 on 
ATF/FBI Lead Agency Jurisdiction; 

D) (U) Conspiracy within United States jurisdiction to damage or destroy property in a foreign 
country and belonging to a foreign country, or to any railroad, canal, bridge, airport, airfield, 
or other public utility, public conveyance, or public stnicture, or any religious, educational, 
or cultural property so situated (18 US.C. § 956[bj); 

E) (U) Destruction of $5,000 or more of an “energy facility" property as defined in 18 U.S.C. § 
1366(c) (18 US.C § 1366[bJ); and 
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F) (U) Willful trespass upon, injury to, destruction of, or interference with fortifications, harbor 
defenses, or defensive sea areas (18 U.S.C. §2152). 

(U) Nothing in this section of the DIOG may be construed to interfere with the USSS under 
18 U.S.C. §3056. 

2.4.2. 3 (U//FOUO) NSPD-46/HSPD-15, "U.S. Policy and Strategyin the War on 

Terror" 


(U//FOUO) Annex II (Consolidation and Updating of Outdated Presidential Counterterrorism 
Documents), dated January 10, 2007, to the classified National Security Presidential Directive 
(NSPD1 46/Homeland Security Presidential Directive (HSPD) 15. dated March 6, 2006, 
establis hes FBI lead responsibilities, as well as those of other federal entities, in the “War on 
Terror”! 


(U//FOUO) Areas addressed in Annex Ilf 


b7E 


| Both NSPD-46/HSPD-15 and Annex II thereto are 

classified. 

2.4.3 (U) Counterintelligence and Espionage Investigations 

(U//FOUO) A representative list of federal statutes applicable to counterintelligence and 
espionage investigations appears below. For additional information, refer to the classified 
Counterintelligence Division (CD) Policy Implementation Guide (PG) and the current list of 
espionage and counterintelligence authorities . 

2.4.3.1 (U) Espionage Investigations of Persons in United States Diplomatic 
Missions Abroad 

(U) Section 603 of the Intelligence Authorization Act of 1990 (P.L. 101-193) states that, 
subject to the authority of the Attorney General, “the FBI shall supervise the conduct of all 
investigations of violations of the espionage laws of the United States by persons employed 
by or assigned to United States diplomatic missions abroad. All departments and agencies 
shall provide appropriate assistance to the FBI in the conduct of such investigations.” Consult 
the Attorney General’s extraterritorial guidelines and other applicable policy or agreements. 

2.4.3.2 (U) Investigations of Unauthorized Disclosure of Classified Information 
to a Foreign Power or Agent of a Foreign Power 

(U) The National Security Act of 1947, as amended, establishes procedures for the 
coordination of counterintelligence activities (50 U.S.C. § 402a). Part of that statute requires 
that, absent extraordinary circumstances as approved by the President in writing on a case-by- 
case basis, the head of each executive branch department or agency must ensure that the FBI 
is “advised immediately of any information, regardless of its origin, which indicates that 
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classified information is being, or may have been, disclosed in an unauthorized manner to a 
foreign power or an agent of a foreign power.” 

2.4.4 (U) Criminal Investiga tions 

(U//FOUO) In addition to the statutes listed above and below, refer to the appropriate 
program/sub-program Criminal Investigative Division (CIDI PG for additional criminal 
jurisdiction information. 

2.4.4.1.1 (U) Investigations of aircraft privacy and related violations 

(U) The FBI shall investigate any violation of 49 U.S.C. § 46314 (Entering aircraft or airport 
areas in violation of security requirements) or chapter 465 (Special aircraft jurisdiction of the 
United States) of Title 49, United States Code; (28 U.S.C. § 538) 

2.4.4.1.2 (U) VIOLENT CRIMES AGAINST FOREIGN TRAVELERS 

(U) The Attorney General and Director of the FBI shall assist state and local authorities in 
investigating and prosecuting a felony crime of violence in violation of the law of any State in 
which the victim appears to have been selected because he or she is a traveler from a foreign 
nation; (28 U.S.C. § 540A[b]) 

2.4.4.1.3 (U) Felonious killings of state and local law enforcement officers 

(U) The FBI shall investigate any violation of 28 U.S.C. § 540; and 

2.4.4.1.4 (U) Investigations of serial killings 

(U) The FBI shall investigate any violation of 28 U.S.C. § 540B. 

2.4.5 (U) Authority of an FBI Special Agent 

(U) An FBI Special Agent has the authority to: 

A) (U) Investigate violations of the laws, including the criminal drug laws, of the United States 
(21 U.S.C. § 871; 28 U.S.C. §§ 533, 534 and 535; 28 C.F.R. § 0.85); 

B) (U) Collect evidence in investigations in which the United States is or may be a party in 
interest (28 C.F.R. § 0.85 [a]) as redelegated through exercise of the authority contained in 
28 C.F.R. § 0. 138 to direct personnel in the FBI; 

C) (U) Make arrests (18 U.S.C. §§ 3052 and 3062); 

D) (U) Serve and execute arrest warrants and seize property under warrant; issue and/or serve 
administrative subpoenas; serve subpoenas issued by other proper authority; and make civil 
investigative demands (18 U.S.C. §§3052, 3107; 21 U.S.C. §876; 15 U.S.C. § 1312); 

E) (U) Carry firearms (18 U.S.C. § 3052); 

F) (U) Administer oaths to witnesses attending to testify or depose in the course of investigations 
of frauds on or attempts to defraud the United States or irregularities or misconduct of 
employees or agents of the United States (5 U.S.C. § 303); 
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G) (U) Seize property subject to seizure under the criminal and civil forfeiture laws of the United 
States (e.g., 18 U.S.C. §§ 981 and 982); and 

H) (U) Perform other duties imposed by law. 

(U) Note : For policy regarding Agent’s authority to intervene in non-federal crimes or make non- 
federal arrests, see Section 19.3.3. 

2.5 (U) Status as Internal Guidance 

(U) The AGG-Dom, this DIOG, and the various operational division PGs are set forth solely for 
the purpose of internal DOJ and FBI guidance. They are not intended to, do not, and may not be 
relied upon to create any rights, substantive or procedural, enforceable by law by any party in 
any matter, civil or criminal, nor do they place any limitation on otherwise lawful investigative 
and litigative prerogatives of the DOJ and the FBI. (AGG-Dom, Part I.D.2.) 

2.6 (U) Departure from the AGG-Dom (AGG-Dom I.D.3) 

2. 6.1 (U) Definition 

(U//FOUO) A “departure” from the AGG-Dom is a deliberate deviation from a known 
requirement of the AGG-Dom. The word “deliberate” means the employee was aware of the 
AGG-Dom requirement and affirmatively chose to depart from it for operational reasons before 
the activity took place. Departures from the AGG-Dom may only be made in accordance with 
the guidance provided in this section. 

2. 6.2 (U) Departure from the A GG-Dom in Advance 

(U//FOUO) A departure from the AGG-Dom must be approved by the Director of the FBI, by 
the Deputy Director of the FBI, or by an Executive Assistant Director (EAD) designated by the 
Director. The Director of the FBI has designated the EAD National Security Branch (NSB) and 
the EAD Criminal Cyber Response and Services Branch (CCRSB) to grant departures from the 
AGG-Dom. Notice of the departure must be provided by Electronic Communication (EC) to the 
General Counsel (GC) using file number 333-HQ-C1629406. The Office of the General Counsel 
(OGC) must provide timely written notice of departures from the AGG-Dom to either the DOJ 
Criminal Division or National Security Division (NSD), whichever is appropriate, or to both, and 
the Criminal Division or NSD must notify the Attorney General and the Deputy Attorney 
General. Notwithstanding this paragraph, all activities in all circumstances must be carried out in 
a manner consistent with the Constitution and laws of the United States. (AGG-Dom, Part I.D.3.) 

2. 6.3 (U) Emergency Departures from the AGG-Dom 

(U//FOUO) If a departure from the AGG-Dom is necessary without prior approval because of the 
immediacy or gravity of a threat to the safety of persons or property or to the national security, 
an FBI employee may, at his/her discretion, depart from the requirements of the AGG-Dom 
when the designated approving authority for the investigative activity cannot be contacted 
through reasonable means. The Director, the Deputy Director, or a designated EAD, and the GC 
must be notified by EC of the departure as soon thereafter as practicable, but not more than 5 
business days after the departure using file number 333-HQ-C 1629406. The OGC must provide 
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timely written notice of departures from the AGG-Dom to either the DOJ Criminal Division or 
NSD, whichever is appropriate, or to both of them, and the Criminal Division or NSD must 
notify the Attorney General and the Deputy Attorney General. Notwithstanding this paragraph, 
all activities in all circumstances must be carried out in a manner consistent with the Constitution 
and laws of the United States. (AGG-Dom, Part I.D.3.) 

2. 6.4 (U) Records of Departures from the AGG-Dom 

(U//FOUO) The OGC is responsible for maintaining records of all requests and approvals or 
denials of departures from the AGG-Dom. Records will be maintained in file number 333-HQ- 
C 1629406. 

2.7 (U) Departures from the DIOG 

2. 7.1 (U) Definition 

(U//FOUO) A “departure” from the DIOG is a deliberate deviation from a known requirement of 
the DIOG. The word “deliberate” means the employee was aware of the DIOG requirement and 
affirmatively chose to depart from it for operational reasons before the activity took place. 
Departures from the DIOG may only be made in accordance with the guidance provided in this 
section. 


2. 7.2 (U) Departure from the DIOG 

(U//FOUO) A request for a departure from the DIOG must be submitted with an EC using file 
number 333-HQ-C 1629406 and approved by the appropriate operational program Assistant 
Director (AD) with notice to the GC. Notwithstanding this paragraph, all activities in all 
circumstances must be carried out in a manner consistent with the Constitution and laws of the 
United States. 

(U//FOUO) OGC will review all departures from the DIOG. If OGC determines the departure 
from the DIOG also involves a departure from the AGG-Dom, OGC must provide timely written 
notice to DOJ in accordance with the provisions of Section I.D.3 of the AGG-Dom. 

2. 7.3 (U) Emergency Departures from the DIOG 

(U//FOUO) FBI employees may conduct or engage in investigative activity that deviates from 
the requirements of the DIOG, including utilizing investigative methods, without prior approval, 
when the designated approving authority for the investigative activity (if any) cannot be 
contacted through reasonable means and in the judgment of the employee one of the following 
factors is present: 

A) (U//FOUO) an immediate or grave threat to the safety of persons or property exists, or 

B) (U//FOUO) an immediate or grave threat to the national security exists, or 
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C) (U//FOUO) a substantial likelihood exists that a delay will result in the loss of a significant 
investigative opportunity . 1 

(U//FOUO) The appropriate operational program AD and the GC must be notified of the 
emergency departure by EC using file number 333-HQ-C1629406 as soon as practicable, but no 
later than 5 business days after engaging in the activity or utilizing the investigative method. This 
documentation must also be filed in the applicable investigative file in which the. activity or 
method was taken. OGC will review all departures from the DIOG. If OGC determines the 
departure from the DIOG also involves a departure from the AGG-Dom, OGC must provide 
timely written notice to DOJ in accordance with the provisions of Section I.D.3 of the AGG- 
Dom. Notwithstanding this paragraph, all activities in all circumstances must be carried out in a 
manner consistent with the Constitution and laws of the United States. 

2. 7.4 (U) Records of Departures from the DIOG 

(U//FOUO) The OGC is responsible for maintaining records of all requests and approvals or 
denials of departures from the DIOG. Records will be maintained in file number 333-HQ- 
C 1629406. 

2.8 (U) Discovery of Non-compliance with DIOG Requirements after-the- 

fact 

2.8.1 (U) Substantial Non-Compliance with the DIOG 

2.8.1.1 (U) Substantial Non-Compliance 

(U//FOUO) “Substantial non-compliance” means non-compliance that is of significance to the 
matter and is more than a minor deviation from a DIOG requirement. 2 Non-compliance that 
relates solely to administrative or peripheral requirements is not substantial. Substantial non- 
compliance specifically includes the following: 

A) (U//FOUO) the unauthorized use of an investigative method; 

B) (U//FOUO) the failure to obtain required supervisory approval ; 3 and 

C) (U//FOUO) non-compliance that has a potential adverse effect upon a member of the public ’s 
individual rights or liberties. 

(U//FOUO) Example A: During an Assessment,! | b7E 

to conduct surveillance. 

Because the approval was not obtained in advance nor was it done pursuant to an emergency 


1 (U//FOUO) This is not a permissible factor for departing from the AGG-Dom. Thus, this factor may only 
provide a basis for a departure from the DIOG that does not require a departure from the AGG-Dom. 

2 (U//FOUO) Departures from the AGG-Dom and the DIOG do not fall within the definition of "non- 
compliance" as used in this section. Departures are to be handled as described Sections 2.6 and 2.7 and 
should not be reported as "non-compliance" matters. 

3 (U//FOUO) If supervisory approval was obtained pursuant to Section 2.7.3 (Emergency Departure from the 
DIOG), the failure to document this approval within 5 business days is a reportable "substantial non- 
compliance" matter. 
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situation as described in 2.7.3, this would be “substantial” non-compliance with DIOG 
sections 18.5.8.3.3 and 18.5.8.3.4 and must be reported to OIC as set forth in 2.8.2 below. 

(U//FOUO) Example B: A new SSA arrives in a squad and discovers that his predecessor did 
not conduct file reviews in several of the squad’s Predicated Investigations for several 
months. This is “substantial non-compliance” and must be reported. 

2.8.1.2 (U) Other Non-Compliance 

(U//FOUO) Non-compliance with the DIOG that is not “substantial” may be reported, but it is 
not mandatory to do so. However, an employee who discovers non-compliance that appears to 
be non-substantial must report the non-compliance to the Division Compliance Officer (DCO) 
for final determination. If there is uncertainty regarding whether a particular matter is 
substantial or not, the matter should be reported. Nevertheless, whenever non-compliance is 
discovered (whether reported or not), appropriate remedial action must be taken by the 
relevant employee(s) to correct the non-compliance, including implementing any preventative 
measures that would help eliminate possible future non-compliance. 

(U//FOUO) Example: An SSA discovers that she conducted a file review 20 days late. This 
relates to an administrative requirement and, without more, is not “substantial” 
noncompliance; this does not have to be reported to OIC. The SSA should, however, take 
appropriate preventative measures to avoid recurrence. 

2.8.2 (U) Documentation of Substantial non-Compliance 

(U//FOUO) Substantial non-compliance with the DIOG must be reported. The report should be 
submitted by the party committing the non-compliance, if at all possible. It must be reported via 
EC or subsequent form. The EC must include the following information: 

A) (U//FOUO) The relevant DIOG provisions) involved; 

B) (U//FOUO) Description of the facts and circumstances (including dates) of the substantial 

non-compliance; 

C) (U//FOUO) The date the substantial non-compliance was discovered; 

D) (U//FOUO) Circumstances leading to the discovery of the substantial non-compliance; 

E) (U//FOUO) If the substantial non-compliance was the result of the failure to obtain 
appropriate supervisory approval (e.g., failure to comply with the requirements of section 

2. 7.4) in the context of an emergency departure from the DIOG, a statement as to whether that 
official, or the current official in the appropriate supervisory position, would have approved 
the action if a timely request had been made based on the facts and circumstances then 

known; 

F) (U//FOUO) Known adverse consequences, if any, attributable to the substantial non- 
compliance; and 

G) (U//FOUO) Corrective or remedial action(s) taken or planned to be taken to mitigate the 
substantial non-compliance, as well as to help prevent such occurrences in the future. 

(U//FOUO) Example: An ASAC discovers that a Preliminary Investigation (PI) was extended 
without obtaining the proper approvals. The failure to obtain appropriate supervisory approval to 
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extend the Preliminary Investigation must be reported, and the report must address all of the 
seven areas in A-G listed above. 

2.8.3 (U) Reporting Authorities 

(U//FOUO) If the substantial non-compliance occurred in a field office, the EC must be 
approved by the DCO and addressed to the ADIC/SAC. If the substantial non-compliance 
occurred at FBI Headquarters (FBIHQ), the EC must be approved by the DCO and addressed to 
the employee’s Assistant Director. A copy of the EC must be provided to the Office of Integrity 
and Compliance (OIC) and to the Office of the General Counsel (OGC) using file number 3 190- 
HQ-A1561245-OIC. A copy of the EC should also be sent to the investigative file in which the 
incident occurred. In addition, if the ADIC/SAC or AD assesses that the non-compliance appears 
to reflect intentional or willful misconduct, it must be reported separately by EC to the Internal 
Investigations Section of the Inspection Division. 

2.8.4 (U) Role of OIC and OGC 

(U//FOUO) OGC will review all reports of substantial non-compliance to determine whether any 
further action is required in the particular matter. OIC will analyze substantial non-compliance 
reports to determine whether any trends exist in the data and will develop strategies to reduce the 
occurrences of substantial non-compliance. Based upon OIC’s analysis of these reports, if OIC 
discovers a systemic problem of non-compliance with the AGG-Dom or DIOG involving 
intelligence activities, either division or FBI wide, OIC must notify OGC/NSLB of this systemic 
problem. 

(U//FOUO) Example A: An IA discovers that a mail cover was used in an Assessment. Because 
mail covers are not permitted to be used in Assessments, this must be reported as a “substantial” 
non-compliance with the DIOG. 

(U//FOUO) Example B: A supervisor determines that a Type 1 & 2 Assessment was opened 
based solely on the exercise of First Amendment rights. While no supervisory approval was 
required to open the Type 1 & 2 Assessment, this must be reported as “substantial” non- 
compliance because opening an Assessment based solely on First Amendment activity affects an 
individual’s rights and liberties. 

2.8.4.1 (U) DISCONTINUATION OF REPORTING 

(U//FOUO) If OIC determines that a sufficient amount of data has been received regarding a 
particular substantial non-compliance issue to identify a systemic trend, the OIC AD may 
eliminate the reporting requirement by providing written notification to the field and 
headquarters divisions indicating that the reporting of a particular substantial non-compliance 
matter to OIC is no longer necessary or required. OIC must coordinate with OGC and CPO 
before written notification is provided to field and headquarter divisions to ensure no reporting 
obligations outside the FBI will be affected, and to ensure all logical data collection pertaining to 
the substantial non-compliance has been acquired. The OIC written notification must be 
documented in case file number 31 90-HQ-A 1561 245-OIC. 
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2.8.5 (U) Potential IOB matters involving the reports of Substantial 

Non-Compliance 

(U//FOUO) If the substantial non-compliance is also a potential IOB matter, the matter must be 
reported in accordance with the requirements and procedures for reporting potential IOB matters 
to OGC/NSLB. See Corporate Policy Directive 0188D: Guidance on Intelligence Oversight 
Board Matters (See 0 1 880^ ; the Policy Implementation Guide 0188PG: and see DIOG Section 4. 
No additional reporting of the incident needs to be made to OIC under this section. 

2.8.6 (U) Reporting Non-Compliance with Policy Implementation Guides 

(U//FOUO) Substantial non-compliance with DIOG-related Policy/Program Guides must be 
reported by EC or subsequent form to the SAC/ADIC, with a copy to the pertinent Headquarters 
Program Manager, and to the OIC, OGC, and the CPO using file number 3 190-HQ-A1561245- 
OIC. 

2.8.7 (U) Reporting Non-Compliance with other FBI Policies and 
Procedures (outside the DIOG) 

(U//FOUO) Nothing in this section is intended to alter, limit, or restrict existing policies that 
require non-compliance to be reported in areas not covered by the DIOG. Employees remain 
responsible to report those other matters. Additional information can be found on the Office of 
Integrity and Compliance’s webpage . 

2.9 (U) Other FBI Activities Not Limited by AGG-Dom 

(U) The AGG-Dom apply to FBI domestic investigative activities and do not limit other 
authorized activities of the FBI. The authority for such other activities may be derived from the 
authority of the Attorney General as provided in federal statutes, guidelines, or Executive Orders. 
The scope and approval of these other authorized activities are addressed in the policies that 
govern the activity and these policies must be relied on when engaging in such activities. 
Examples of authorized FBI activities not governed by the AGG-Dom include, but are not 
limited to, the FBI’s responsibilities to conduct background checks and inquiries concerning 
applicants and employees under federal personnel security programs (e.g., background 
investigations), FBI physical building security issues, Office of Professional 
Responsibility/personnel issues, certain administrative claims/civil actions, the FBI’s 
maintenance and operation of national criminal records systems and preparation of national 
crime statistics, and the forensic assistance and administration functions of the FBI Laboratory. 
(AGG-Dom, Part I.D.4.) 

(U) FBI employees may incidentally obtain information relating to matters outside of the FBI’s 
primary investigative responsibility. For example, information relating to violations of state or 
local law or foreign law may be incidentally obtained in the course of investigating federal 
crimes or threats to the national security or in collecting foreign intelligence. Neither the AGG- 
Dom nor the DIOG bar the acquisition of such information in the course of authorized 
investigative activities, the retention of such information, or its dissemination as appropriate to 
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the responsible authorities in other jurisdictions. (See Section 14; AGG-Dom, Part II and Part 
VLB) 

2.10 (U) Use of Classified Investigative Technologies 

(U) Inappropriate use of classified investigative technologies may risk the compromise of such 
technologies. Hence, in an investigation relating to activities in violation of federal criminal law 
that does not concern a threat to the national security or foreign intelligence, the use of such 
technologies must be in conformity with the Procedures for the Use of Classified Investigative 
Technologies in Criminal Cases (AGG-Dom, Part V.B.2), Operational Technology Division 
(OTD) Domestic Technical Assistance (DTA) Policy Implementation Guide (PG), and any other 
FBI policies concerning such technology use. 

2.11 (U) Application of AGG-Dom and DIOG 

(U//FOUO) The AGG-Dom and DIOG apply to all FBI domestic investigations and operations 
conducted by an “FBI employee” or an FBI confidential human source (CHS), when operating 
pursuant to the tasking or instructions of an FBI employee. The term “FBI employee” includes, 
but is not limited to, an operational/administrative professional staff person, intelligence analyst, 
special agent, task force officer (TFO), task force member (TFM), task force participant (TFP), 
detailee, and FBI contractor. Both an “FBI employee” and a CHS, when operating pursuant to 
the tasking or instructions of an FBI employee, are bound by the AGG-Dom and DIOG. In the 
DIOG, “FBI employee” includes all personnel descriptions, if not otherwise prohibited by law or 
policy. For example, if the DIOG states that the “FBI employee” is responsible for a particular 
investigative activity, the supervisor has the flexibility to assign that responsibility to any person 
bound by the AGG-Dom and DIOG (e.g., agent, intelligence analyst, task force officer), if not 
otherwise prohibited by law or policy. 

(U//FOUO) TFOs, TFMs, TFPs, detailees, and FBI contractors are defined as “FBI employees” 
for purposes of application of the AGG-Dom and DIOG. However, for overt representational 
purposes, TFOs, TFMs, TFPs, detailees and FBI contractors should identify themselves as 
employees of their parent agency and, if appropriate and necessary, affiliated with a particular 
FBI investigative entity, such as the JTTF, etc. A CHS is likewise bound by the AGG-Dom, 
DIOG, AGG-CHS, and other applicable CHS policies when operating pursuant to the tasking or 
instructions of an FBI employee; however, the FBI CHS is not an employee of the FBI. 

(U//FOUO) TFOs, TFMs, TFPs, detailees, and FBI contractors are defined as “FBI employees” 
only for purposes of the AGG-Dom and DIOG. This inclusive definition does not define federal 
employment for purposes of the Federal Tort Claims Act, 28 U.S.C. §§ 1346(b), 2401, and 2671 
et seq.; the Federal Employees Compensation Act, 5 U.S.C. § 8101 et seq.; the 
Intergovernmental Personnel Act, 5 U.S.C. § 3374 et seq, or any other law. 

(U//FOUO) No policy or PG may contradict, alter or otherwise modify the standards of the 
DIOG. Requests for DIOG modifications can be made to the Corporate Policy office (CPO) 
pursuant to DIOG Section 3.2.2 paragraphs (A), (B), (C) and (D). 
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3 (U) CORE VALUES, ROLES, AND RESPONSIBILITIES 


3.1 (U) The FBI’s Core Values 

(U) The FBI’s core values guide and further our mission and help us achieve our many goals. 

The values do not exhaust the many goals we wish to achieve, but they capsulate the goals as 
well as can be done in a few words. The FBI’s core values must be folly understood, practiced, 
shared, vigorously defended, and preserved. The values are: 

A) (U) Rigorous obedience to the Constitution of the United States 

B) (U) Respect for the dignity of all those we protect 

C) (U) Compassion 

D) (U) Fairness 

E) (U) Uncompromising personal integrity and institutional integrity 

F) (U) Accountability by accepting responsibility for our actions and decisions and their 
consequences 

G) (U) Leadership, by example, both personal and professional 

(U) By observing these core values, we achieve a high level of excellence in performing the 
FBI’s national security and criminal investigative functions as well as the trust of the American 
people. Our individual and institutional rigorous obedience to constitutional principles and 
guarantees is more important than the outcome of any single interview, search for evidence; or 
investigation. Respect for the dignity of all reminds us to wield law enforcement powers with 
restraint and to avoid placing our self interest above that of those we serve. Fairness and 
compassion ensure that we treat everyone with the highest regard for constitutional, civil, and 
human rights. Personal and institutional integrity reinforce each other and are owed to our Nation 
in exchange for the sacred trust and great authority conferred upon us. 

(U) We who enforce the law must not merely obey it. We have an obligation to set a moral 
example that those whom we protect can follow. Because the FBI’s success in accomplishing its 
mission is directly related to the support and cooperation of those we protect, these core values 
are the fiber that holds together the vitality of our institution. 

3.1.1 (U) Compliance 

(U) All FBI personnel must folly comply with all laws, rules, and regulations governing FBI 
investigations, operations, programs and activities, including those set forth in the AGG-Dom. 
We cannot, do not, and will not countenance disregard for the law for the sake of expediency in 
anything we do. The FBI expects its personnel to ascertain the laws and regulations that govern 
the activities in which they engage and to acquire sufficient knowledge of those laws, rules, and 
regulations to understand their requirements, and to conform their professional and personal 
conduct accordingly. Under no circumstances will expediency justify disregard for the law. FBI 
policy must be consistent with Constitutional, legal, and regulatory requirements. Additionally, 
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the FBI must provide sufficient training to affected personnel and ensure that appropriate 
oversight monitoring mechanisms are in place. 

(U//FOUO) In general, the FBI requires employees to report known or suspected failures to 
adhere to the law, rules or regulations by themselves or other employees, to any supervisor in the 
employees’ chain of command; any Division Compliance Officer; any Office of the General 
Counsel (OGC) Attorney; any Inspection Division personnel; any FBI Office of Integrity and 
Compliance (OIC) staff; or any person designated to receive disclosures pursuant to the FBI 
Whistleblower Protection Regulation (28 Code of Federal Regulations § 27.1), including the 
Department of Justice (DOJ) Inspector General. For specific requirements and procedures for 
reporting “departures” and “non-compliance” with the AGG-Dom on the DIOG, see DIOG 
Section 2. 

3.2 (U) Investigative Authority, Roles and Responsibility of the 

Director's Office 

3.2. 1 (U) Director ’s Authority, Roles and Responsibility 

(U//FOUO) The Director's authority is derived from a number of statutory and regulatory 
sources. For example, Sections 531 through 540a of Title 28, United States Code (U.S.C.), 
provide for the appointment of the Director and enumerate some of his powers. More 
importantly, with regard to promulgation of the DIOG, Section 301 of Title 5, U.S.C., authorizes 
the head of an Executive department to "prescribe regulations for the government of his 
department, the conduct of its employees, the distribution and performance of its business, and 
the custody, use, and preservation of its records, papers, and property." The Attorney General, as 
head of the DOJ, has delegated the authority in Section 301 to the Director in a variety of orders 
and regulations. Foremost among these delegations are Subpart P and Section 0.137 of Title 28, 
Code of Federal Regulations (C.F.R.). This DIOG is promulgated under the authority thus 
delegated. 

(U//FOUO) The Director's role and responsibilities under the AGG-Dom and DIOG, include, 
among others, the approval or denial of departures from the AGG-Dom, Undisclosed 
Participation (UDP) (see DIOG Section 16) and Sensitive Operations Review Committee 
(SORC) matters (see DIOG Section 10). 

3.2.2 (U) Deputy Director's Authority, Roles and Responsibility 

(U//FOUO) The Deputy Director is the proponent of the DIOG, and in that position has oversight 
regarding compliance with the DIOG and subordinate implementing procedural directives and 
divisional specific PGs. The Deputy Director is also responsible for the development and the 
delivery of necessary training and the execution of the monitoring and auditing processes. 

(U//FOUO) The Deputy Director works through the Corporate Policy Office (CPO) to ensure the 
following: 

A) (U//FOUO) The DIOG is updated as necessary to comply with changes in the law, rules, or 
regulations; 
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B) (U//FOUO) The DIOG is reviewed every three years after the effective date of the 201 1 
revision, and revised as appropriate. This mandatory review schedule, however, does not 
restrict the CPO, which is responsible for all corporate policy matters, from working with FBI 
Headquarters (FBIHQ) divisions and field offices in the meantime to make policy revisions to 
the DIOG and the PGs whenever necessary and appropriate during the three year period. The 
CPO may also make technical or non-substantive language or formatting changes to the 
DIOG, as necessary, provided those changes clarity the meaning without altering the 
substance of the DIOG; 

C) (U//FOUO) Existing and proposed investigative and administrative policies and PGs comply 
with the standards established in the AGG-Dom and DIOG. On behalf of the Deputy Director, 
the CPO has the authority, following coordination with the OIC and OGC, to modify or 
remove any provision of existing or proposed investigative or administrative policies or PGs 
determined to violate, contradict, or otherwise modify the intent or purpose of any provision 
or standard established in the AGG-Dom or DIOG; and 

D) (U//FOUO) If the CPO makes any changes to the DIOG or other policy pursuant to DIOG 
Sections 3.2.2.B and/or 3.2.2.C above, the CPO will immediately advise by e-mail all FBIHQ 
and field office Division Policy Officers (DPO) of such changes and all DPOs must further 
advise their respective FBI employees of such changes. The electronic version of the DIOG 
maintained in the CPO’s Policy and Guidance Library is the official current policy of the FBI. 

3.3 (U) Special Agent/Intelligence Analyst/Task Force Officer 

(TFO) /Task Force Member (TFM) /Task Force Participant (TFP) /FBI 
Contractor/Others - Roles and Responsibilities 

3.3.1 (U) Roles and Responsibilities 

(U//FOUO) Special Agents, analysts, TFO, TFM, TFP, FBI contractors and others bound by the 

AGG-Dom and DIOG must: 

3.3.1.1 (U) Training 

(U//FOUO) Obtain training on the DIOG standards relevant to his/her position and perform 
activities consistent with those standards; 

3.3.1.2 (U) Investigative Activity 

(U//FOUO) Ensure all investigative activity complies with the Constitution, Federal law, 
executive orders, Presidential Directives, AGG-Dom, other Attorney General Guidelines 
(AGG), Treaties, Memoranda of Agreement/Understanding, the DIOG, and any other 
applicable legal and policy requirements (if an agent, analyst, TFO, or other individual is 
unsure of the legality of any action, he/she must consult with his/her supervisor, the Chief 
Division Counsel (CDC) or OGC); 

3.3.1.3 (U) Privacy and Civil Liberties 

(U//FOUO) Ensure that civil liberties and privacy are protected throughout the Assessment or 
investigative process; 
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3.3.1.4 (U) Protect Rights 

(U//FOUO) Conduct no investigative activity based solely on the exercise of First 
Amendment activities (i.e., the free exercise of speech, religion, assembly, press or petition) 
or on the race, ethnicity, national origin or religion of the subject (See DIOG Section 4); 

3.3.1.5 (U) Compliance 

(U//FOUO) Ensure compliance with the DIOG, including standards for opening, conducting, 
and closing an investigative activity; collection activity; or use of an investigative method, as 
provided in the DIOG; 

3.3. 1.6 (U) Report Non-Compliance 

(U//FOUO) Comply with the law, rules, or regulations, and report any non-compliance 
concern to the proper authority. For specific requirements and procedures for reporting 
departures and non-compliance with the AGG-Dom and the DIOG, see DIOG Sections 2.6 - 
2 . 8 ; 


3.3.1.7 (U) Assist Victims 

(U//FOUO) Identify victims who have suffered direct physical, emotional, or financial harm 
as result of the commission of Federal crimes, offer the FBI's assistance to victims of these 
crimes and provide victims' contact information to the responsible FBI Victim Specialist 
(VS). The VS is thereafter responsible for keeping victims updated on the status of the 
investigation to the extent permitted by law, regulation, or policy, unless the victim has opted 
not to receive assistance. The FBI's responsibility for assisting victims is continuous as long 
as there is an open investigation (see the Office of Victim Assistance PG) : 

3.3.1.8 (U) Obtain Approval 

(U//FOUO) Ensure appropriate supervisory approval is obtained for investigative activity as 
required in the DIOG. Obtain and document oral approval as specified in Section 3.4.2.2 
below. Self-approval of DIOG activities is not permitted. See “No Self- Approval Rule” set 
forth in Section 3.4.2.3 below; 

3.3.1.9 (U) Attribute Information to Originator in Reports 

(U//FOUO) Ensure that if the originator of information reported to the FBI characterizes an 

individual, group, or activity in a certain way, FBI records (i.e., 302s, ECs, LHMs, etc.) 
reflect that another party, and not the FBI, is the originator of the characterization. Example: 
An FBI document should state: “The complainant advised that the subject was prejudiced and 
motivated by ethnic bias” rather than “The subject was prejudiced and motivated by ethnic 
bias;” 


3.3.1.10 (U) Serve as Investigation ("Case") Manager 

(U//FOUO) If assigned responsibility for an investigation, manage all aspects of that 
investigation, until it is assigned to another person. It is the employee's responsibility to . 
ensure compliance with all applicable laws, rules, regulations, and guidelines, both 
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investigative and administrative, from the opening of the investigation through disposition of 
the evidence, until the investigation is assigned to another person. If assigned as a co-case 
agent, co-case manager, or if assigned case-related activities or duties, it is the employee's 
responsibility to ensure compliance with all applicable laws, rules, regulations, and 
guidelines, both investigative and administrative, from the opening of the investigation 
through disposition of the evidence, until the investigation is assigned to another person or the 
case related activity requirement(s) ends. 

3.3.1.11 (U) Create and Maintain Records/Files 

(U//FOUO) Create and maintain authentic, reliable, and trustworthy records, establish files, 
set leads, supervise investigations, index documents, and retain and share information, as 
specified in DIOG Section 14 and Appendix J; 

3.3.1.12 (U) Index Documents 

(U//FOUO) If assigned responsibility for an investigation, index information i n documents. 

Current guidance for indexing docu ments may be found in DIOG Appendix J, 

hnd on the RMD website ! I b7E 

3.3.1.13 (U) Seek Federal Prosecution 

(U//FOUO) Prefer Federal prosecution rather than state/local prosecution. An FBI employee 
may protect the FBI’s resources and interests when discussing investigations with the United 
States Attorney’s Office (US AO) by accurately representing the time and effort spent on an 
investigation. The USAO should be aware of this information prior to deciding whether 
he/she will decline prosecution in favor of handling by local authorities. Criminal 
investigations conducted by the FBI are designed to obtain evidence for prosecution in 
Federal court and not in state or local courts; and 

3.3.1.14 (U) Retain Notes Made During An Investigation 

(U//FOUO) Retain in the investigative file (1A envelope) the following types of material 
developed when interviewing witnesses: 

A) (U) Statements signed by the witness. 

B) (U) Written statements, unsigned by the witness, but approved or adopted in any manner by 
the witness. 

C) (U) Original notes of interview with prospective witnesses and/or suspects and subjects. That 
is, in any interview where preparation of an FD-302 is required (an interview where it is 
anticipated the results will become the subject of court testimony) the handwritten notes must 
be retained. 

D) (U) Dictating the results of an interview onto an audio tape/media in lieu of taking handwritten 
interview notes may be viewed by a court as “original notes” and, therefore, the audio 
tape/media must be retained. In such circumstances, the audio tape/media becomes the 
“original note” material. Conversely, an audio tape/media used for dictation from handwritten 
interview notes for transcription to a final FD-302 is not "original note" material and the audio 
tape need not be retained. 
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E) (U) An FBI employee’s notes made to record his/her own finding, must always be retained. 
Such notes include, but are not limited to, accountant's work papers and notes covering 
matters such as crime scene searches, laboratory examinations, and fingerprint examinations. 
If there is a question whether notes must be retained, resolve the question in favor of retaining 
the notes. 

(U) See also DIOG Section 18.5.6.4.15 (Interview Documentation). 

(U) Note : For the purpose of this note retention policy, an interview and an interrogation are 
analogous. 

3.3.2 (U) Definitions of Taskforce Officer (TFO), Task Force Member 

(TFM), and Task Force Participant (TFP) 

(U//FOUO) It is required in some situations for the sponsoring agency of the TFO, TFM and 
TFP to enter into an MOU with the FBI that governs the activities of the Task Force. For 
purposes of the DIOG, TFO, TFM, and TFP are defined as follows: 

3 .3 .2.1 (U) Task Force Officer (TFO) 

(U//FOUO) An individual is a TFO when all of the following apply: 

A) (U//FOUO) The individual is a certified Federal, state, local, or tribal law enforcement officer; 

B) (U//FOUO) The individual is authorized to carry a firearm; 

C) (U//FOUO) The individual is currently deputized under either Title 21 or Title 1 8 of the 
U.S.C.; 

D) (U//FOUO) The individual has been issued Federal law enforcement credentials; 

E) (U//FOUO) The individual is assigned to the supervision of an FBI led task force; 

F) (U//FOUO) The individual has a security clearance recognized by the FBI that is currently 
active; and 

G) (U//FOUO) The individual is authorized to have access to FBI facilities. 

(U//FOUO) An FBI TFO is mandated to attend all DIOG related training, and is bound by all 
rules, regulations, and policies set forth in the DIOG when acting in the capacity as an FBI 
TFO. 

3.3.2.2 (U) Task Force Member (TFM) 

(U//FOUO) An individual is a TFM when all of the following apply: 

A) (U//FOUO) The individual is an employee of a Federal, state, local, or tribal agency; 

B) (U//FOUO) The individual is assigned to the supervision of an FBI led task force; 

C) (U//FOUO) The individual has a security clearance recognized by the FBI that is currently 
active; and 

D) (U//FOUO) The individual is authorized to have access to FBI facilities. 
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(U//FOUO) An FBI TFM is mandated to attend all DIOG related training, and is bound by all 
rules, regulations, and policies set forth in the DIOG when acting in the capacity as an FBI 
TFM. 

3.3.2. 3 (U) Task Force Participant (TFP) (i.e., Task Force Liaison) 

(U//FOUO) An individual is a TFP when he/she participates on an FBI-led task force and 
does not otherwise qualify as a TFO or TFM. A TFP is bound by all rules, regulations, and 
policies set forth in the DIOG when acting in the capacity as an FBI TFP. DIOG related 
training for an FBI TFP may be required by the head of the office/division that governs the 
activities of the Task Force. 

3 .4 (U) Supervisor Roles and Responsibilities 

3.4.1 (U) Supervisor Defined 

(U) The term “supervisor” as used in the DIOG includes (whether in a Field Office or FBIHQ) 
the following positions, or a person acting in such capacity: 

A) (U) Supervisory Special Agent (SSA), 

B) (U) Supervisory Senior Resident Agent (SSRA), 

C) (U) Supervisory Intelligence Analyst (SIA), 

D) (U) Legal Attache (LEGAT), 

E) (U) Deputy Legal Attache (DLAT), 

F) (U) Unit Chief (UC), 

G) (U) Assistant Special Agent in Charge (ASAC), 

H) (U) Assistant Section Chief (ASC), 

I) (U) Section Chief (SC), 

J) (U) Special Agent in Charge (SAC), 

K) (U) Deputy Assistant Director (DAD), 

L) (U) Assistant Director (AD), 

M) (U) Assistant Director in Charge (ADIC), 

N) (U) Associate Executive Assistant Director (A/EAD), 

O) (U) Executive Assistant Director (EAD), 

P) (U) Associate Deputy Director (ADD), and 

Q) (U) Deputy Director (DD). 

(U) The term “supervisor” is also intended to include any other FBI supervisory or managerial 
position that is not specifically listed above but is equal in rank and/or responsibility to these 
listed positions. (Note: TFOs/TFMs cannot be supervisors.) 
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3.4.2 (U) Supervisor Responsibilities 

3.4.2. 1 (U) Approval/Review of Investigative or Collection Activities 

(U//FOUO) Anyone in a supervisory role who approves/reviews investigative or collection 
activity must determine whether the standards for opening, approving, conducting, and 
closing an investigative activity, collection activity or investigative method, as provided in the 
DIOG, have been satisfied. 

3.4.2.2 (U) Oral Authority / Approval 

(U//FOUO) Unless otherwise specified by the AGG-Dom or FBI policy, any 
authority/approval required in the DIOG necessary to conduct investigative activities may be 
granted orally by the appropriate approving official. Should such oral authorization be 
granted, appropriate written documentation of the oral authorization must be documented by 
the FBI employee to the authorizing official as soon as practicable, but not more than five 
business days after the oral authorization. The effective date of any such oral authorization is 
the date on which the oral authority was granted, and that date and the name of the approving 
official must be included in the subsequent written documentation. 

(U//FOUO) Supervisors are not permitted to self-approve investigative or intelligence 
collection activity or methods in assessments or investigations assigned to them as case agents 
or analysts. An independent evaluation and approval of these activities must be obtained 
including the opening and closing of any Assessment or Predicated Investigation. See Section 

3.4.2.3 below. 

3.4.2.3 (U) No Self-Approval Rule 

(U//FOUO) When approval/authority is required in the DIOG, or related policy 
implementation guides, to open, utilize an investigative method, close, or perform any 
administrative requirement within the scope of the DIOG (i.e. initial paperwork to a file, 
perform a file review, etc.), an approving official (supervisor) may not “self-approve” his/her 
own work or activity. An independent evaluation and approval of these activities must be 
obtained, including the opening and closing of any Assessment or Predicated Investigation. 
Note: See Corporate Policy Directive 029 ID, “Supervisory Approval of Administrative 
Records,” for guidance on administrative case files. 

(U//FOUO) Example: An SSA/SIA properly designates a relief supervisor on the squad to act 
as the SSA/SIA while the supervisor is on leave. The relief SSA/SIA may not approve 
anything related to his/her own investigations/work because supervisors are not permitted to 
self-approve investigative or intelligence collection activity or methods in files assigned to 
themselves. 

3 .4.2 .4 (U) Ensure Compliance with U.S. Regulations and other Applicable Legal 
and Policy Requirements 

(U//FOUO) Supervisors must monitor and take reasonable steps to ensure that all 
investigative activity, collection activity and the use of investigative methods comply with the 
Constitution, Federal law, Executive Orders, Presidential Directives, AGG-Dom, other AGG, 
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Treaties, Memoranda of Agreement/Understanding, the DIOG, and any other applicable legal 
and policy requirements. 

3.4.2. 5 (U) Training 

(U//FOUO) Supervisors must obtain training on the DIOG standards relevant to his/her 
position and then conform decisions to those standards. Supervisors must also take reasonable 
steps to ensure that all subordinates have received the required training on the DIOG 
standards and requirements relevant to the subordinate’s position. 

3.4.2.6 (U) Protect Civil Liberties and Privacy 

(U//FOUO) All supervisors must take reasonable steps to ensure that civil liberties and 
privacy are protected throughout the investigative process. 

3.4.2.7 (U) Report Compliance Concerns 

(U//FOUO) If a supervisor encounters a practice that does not comply, or appears not to 
comply, with the law, rules, or regulations, the supervisor must report that compliance 
concern to the proper authority and, when necessary, take action to maintain compliance. For 
specific requirements and procedures for reporting departures and non-compliance with the 
AGG-Dom and the DIOG, see Sections 2.6 - 2.8. 

3.4.2.8 (U) Non-Retaliation Policy 

(U//FOUO) Supervisors must not retaliate or take adverse action against persons who raise 
compliance concerns. (See CPD 0032D, 02/1 1/2008 for the non-retaliation policy') 

3.4.2.9 (U) Create and Maintain Records/Files 

(U//FOUO) Supervisors must ensure that FBI employees create and maintain authentic, 
reliable, and trustworthy records, establish files, set leads, supervise investigations, index 
documents, and retain and share information, as specified in DIOG Section 14. 

(U//FOUO) Supervisors must periodically review investigative, control, and administrative 
files (e.g. 300A file) assigned to their areas of program responsibility or management in 
accordance with DIOG Section 3.4.4 below. 

3.4.3 (U) Delegation and Succession in the FBI 

(U//FOUO) The ability to exercise legal authority within the FBI through delegations of legal 
authority and orderly succession to positions of authority is set forth in the Succession and 
Delegation Policy . 

3.4.3. 1 (U) Delegation 

(U//FOUO) As used in the DIOG, the term “delegation” refers to the conveyance of authority 
to another official (either by position or to a named individual). FBI legal authority is 
generally delegable one supervisory level unless expressly permitted, prohibited, or restricted 
by law, regulation, or policy. For example, an SAC may delegate his/her authority to approve 
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Sensitive Investigative Matters (SIMs) to an ASAC, but the ASAC cannot further delegate 
this authority to an SSA. Delegations will continue in effect until modified, revoked, 
superseded, the position no longer exists, or the named individual vacates the position. 

(U//FOUO) A supervisor may only delegate authority to another supervisor one level junior to 
himself or herself, unless specified otherwise (e.g., an ASAC may delegate authority to an 
SSA). SACs may, however, restrict delegations within their field offices, i.e., an SAC may 
prohibit ASACs from further delegating authorities that have been assigned to them. 

(U//FOUO) SSAs and Supervisory Intelligence Analysts (SIA) cannot “delegate” their 
authority because they are the first level of supervisory responsibility; however, a relief 
supervisor may exercise the SSA’s authority when serving as the “acting” SSA (e.g., when the 
SSA is absent or unavailable). In the absence of the immediate approval authority, a 
supervisor at the same or higher level than that required may approve a particular activity 
(e.g., an Special Agent requests that his/her ASAC or SAC approve a Preliminary 
Investigation because the Agent’s SSA is on a temporary duty assignment). 

3.4.3.2 (U) Succession: Acting Supervisory Authority 

(U//FOUO) As used in the DIOG, the term “succession” refers to the process by which an 
official assumes the authorities and responsibilities of an existing position, typically when the 
incumbent is absent, unavailable, unable to carry out official responsibilities, or has vacated 
the position. A person who temporarily succeeds to a position is referred to as “acting” in that 
position. 

(U//FOUO) The FBI follows the general rule, recognized in law, that employees properly 
designated as “acting” in a position exercise the full legal authorities of that position, unless 
specifically precluded by higher authority or by an applicable law, regulation, or policy. 
Accordingly, unless expressly precluded, any authority vested in an FBI supervisor pursuant 
to the DIOG may be exercised by someone who occupies that position in an acting status. An 
employee may be designated to an acting position either through a succession plan or ad hoc 
designation. See the FBI Succession and Delegation Policy for additional details. 

3.4.3.3 (U) Documentation 

(U//FOUO) Delegations of authority as well as succession plans and ad hoc designations must 
be documented in writing and maintained in the appropriate administrative file identified 
below whenever practicable, unless specifically required by the DIOG. Administrative files 
have been created by RMD to maintain documentation of delegations of authority, to include 
ad hoc designations and succession plans. 

3.4.3.3.1 (U//FOUO) "Delegations of Authority Related to Senior Executives" - File 

31 9X-HQ-A1 700684-XX 

(U//FOUO) File (3 19X-HQ-A1 700684-XX with the last two alpha characters designating 
particular field office, FBIHQ Division or LEGAT must be used to document delegations of 
authority related to the responsibilities of senior executive positions (defined in the Director & 
Senior Officials (07-01) Retention Schedule) as only the Director, Deputy Director, Chief of 
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Staff, Associate Deputy Director, and Executive Assistant Director(s). (Note : This file does 
not include Senior Executive Service (SES) delegations of authority. Such delegations of 
authority by SES and all other supervisory management officials must be documented using 
the file specified below in DIOG Section 3. 4.3. 3. 2) 

3A.3.3.2 ( U//FOUO ) "Delegations of Authority Related to Non-Senior Executives" 

(including All Senior Executive Service [SES] and Other Supervisory 
Management Officials) and All Adhoc Designa tions - File 31 9X-HQ- 

A1700685-XX 

(U//FOUO) File 319X-HQ-A1700685-XX with the last two alpha characters designating 
particular field office, FBIHQ Division or LEGAT must be used to document delegations of 
authority related to the responsibilities of non-senior executive positions to include all SES 
level and other supervisory management officials not included above in DIOG Section 
3.4.3.3.1, as well as to document adhoc designations, as specified. 

(U//FOUO) Documentation of acting authority may take place subsequent to the actual ad hoc 
designation. For example, an SSA orally advises his principal relief supervisor that he/she has 
an emergency and will not be able to come into the office. The ad hoc designation of the relief 
supervisor as acting SSA can be documented upon the SSA’s return to the office. Failure to 
document an ad hoc designation does not invalidate the designation but may result in 
difficulty proving the appropriate exercise of authority if required to do so. (See Section 
3. 4.2.2 above concerning oral authorizations and related documentation requirements). 

3A.3.3.3 (U//FOUO) Succession Plans- File 319X-HQ-A1538387 

(U//FOUO) An administrative file has also been created to maintain documentation of 
succession plans (319X-HQ-A1538387-XX with the last two alpha characters designating the 
particular field office, FBIHQ Division or LEGAT). 

3.4.4 (U) File Reviews and Justifica tion Reviews 

3. 4.4.1 (U) Overview 

(U//FOUO) The file review is designed to ensure investigative and intelligence activities are 
progressing adequately and conducted in compliance with applicable statutes, regulations, and 
FBI/DOJ policies and procedures. As a management tool, the file review process has proven 
effective for operational program oversight, tracking investigative and intelligence collection 
progress, ensuring investigative focus, and reduction of risk. 

(U//FOUO) Supervisory review of investigative files (main file and all sub-files) is especially 
important with regard to tracking the progress and development of new employees. It 
provides an opportunity for supervisors to guide employees on how properly to manage and 
document investigation files, and to use and document investigative methods, while 
emphasizing the importance of compliance and recognition of risk. In addition, the file review 
process is an opportunity to begin to evaluate an employee’s level of performance and to 
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identify his/her strengths and weaknesses. Such performance evaluation must only be 
documented on the Performance Summary Assessment (PSA), not on the file review sheet. 

(U//FOUO) File reviews help supervisors to ensure their office is effectively supervising 
activities in its own territory and monitoring investigative activity carried out on their behalf 
in other field offices. For example, a supervisor may use a file review as a reasonable step to 
ensure the employee assigned an investigation has addressed all logical investigation in a 
timely manner, or to ensure the employee has successfully set necessary leads for other 
offices or other employees within his/her own office. Additionally, the periodic review of 
control files or relevant administrative files permits the supervisor to evaluate progress in 
meeting program related objectives, or in the case of a relevant administrative file (e.g. 

300A), that FBI resources are being utilized and managed properly in accordance with policy 
standards, and aligned with strategic objectives. 

3.4A.2 (U) Types of Files/Investigations Requiring File Reviews and Justification 

Reviews 

(U//FOUO) File reviews (including the main file and all sub-files) must be conducted for all 
Predicated Investigations, including investigations placed in “pending inactive” status, 
unaddressed work files, and Types 3 through 6 Assessments. Type 1 & 2 Assessments must 
have a 30 day justification reviews, as specified below. 

3.4A.3 (U) Frequency of File Reviews 

(U//FOUO) Supervisors must adhere to the following timeframes for file reviews: 

A) (U//FOUO) For agents, Resident Agents, TFOs, and IAs - 90 Days - The supervisor must 
review the files (main and sub-file) for all investigations (including pending Predicated 
Investigations, pending inactive investigations, unaddressed work files, and Type 3-6 
Assessments, or assigned administrative case files such as a 300A) for each consecutive 90 
day period. 

1) (U//FOUO) 30 Additional Days: The file review process and file review documentation, 
as described in DIOG subsections 3.4.4.6 - 3.4.4. 10 below, including tasks identified while 
conducting the in-person or telephonic session, must be completed within 30 calendar days 
following each 90 day file review period. 

B) (U//FOUO) For probationary employees (agent and IA) - 60 Days - The supervisor must 
review the files (main and sub-files) for all investigations (including pending Predicated 
Investigations, pending inactive investigations, unaddressed work files, and Type 3-6 
Assessments, or associated administrative case files such as a 300A) for each consecutive 60 
calendar day period. 

1) (U//FOUO) 30 Additional Days: The file review process and file review documentation, 
as described in DIOG subsections 3.4.4.6 - 3.4.4.10 below, including tasks identified while 
conducting the in-person or telephonic session, must be completed within 30 calendar days 
following each 90 day file review period. 

3A.4.3.1 (U) File Review Example: 

(U//FOUOTI 


Version Dated: 
October 16, 2013 


3-12 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 


UNCLASSIFIED - FOR OFFICIAL USE ONLY 



3.4.4A (U) Frequency of Justification Reviews 


(U//FOUO) In addition to file reviews, every 30 days supervisors must complete “justification 
reviews” for Type 1 & 2 Assessments, as specified below. 

3.4.4.5 (U) Delegation of File Reviews 

(U//FOUO) Thorough, complete and well conducted file reviews are an important part of the 
compliance regime, provide valuable and needed information for purposes of evaluating the 
performance of employees, and are critical to the effective management of a squad. For those 
reasons, file reviews are an important duty and responsibility for Supervisors, and Supervisors 
are discouraged from routinely delegating these reviews. Because, however, conducting a file 
review is an important developmental opportunity for primary relief supervisors, file reviews 
may be conducted by a duly designated acting supervisor or duly designated primary relief 
supervisor. Acting supervisors may conduct file reviews just as they would conduct any other 
supervisory duty while functioning in an acting capacity. Primary relief supervisors may 
conduct file reviews; however, when they do so, the next required file review must be 
conducted by a supervisor or duly designated acting supervisor. In other words, every other 
file review of any given investigative file must be conducted by a supervisor or duly 
designated acting supervisor. Acting supervisors may not review their own files under any 
circumstances. Acting supervisors must either reassign their investigations or have their 
investigations reviewed by another supervisor or an ASAC. 

3.4.4.6 (U) File Review Requirements for Predicated Investigations & 
Assessments 

(U//FOUO) A file review or justification review must be: conducted in person or by telephone 
when necessary (e.g., FBI employee is TDY or in a remote Resident Agency (RA)); 
conducted in private; and documented as specified below. 

(U//FOUO) The file review process requires the supervisor to review the investigative files 
(including the main file and all sub-files) assigned to the employee, discuss past progress and 
future objectives, and document that information on the File Review Sheet generated by the 
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FBI’s central recordkeeping system. Discussion and documentation must also include the 
progress of the investigation/Assessment since the previous file review and the projected 
work for the time period until the next file review. 

(U//FOUO) When reviewing the employee’s assigned investigative files (main file and sub- 
files), the supervisor should consider the following: 

A) (U//FOUO) Whether subject(s) have been indexed in compliance with indexing guidelines; 

B) (U//FOUO) Whether statistical accomplishments, i.e., accomplishments in the 
Accomplishments module of the FBI's central recordkeeping system, have been entered within 
established timeframes; 

C) (U//FOUO) Whether evidence has been stored and disposed of properly and whether 
documentation has been completed according to evidence control policies; 

D) (U//FOUO) Whether leads have been covered within established deadlines; 

E) (U//FOUO) Whether any National Security Letters have been issued in accordance with 
policy, including whether responsive materials have been appropriately examined (e.g., 
examined for overproduction); 

F) (U//FOUO) Whether any Federal Grand Jury Subpoenas have been issued in accordance with 
policy, including whether responsive materials have been appropriately examined (e.g., 
examined for overproduction); 

G) (U//FOUO) Whether any Administrative Subpoenas have been issued in accordance with 
policy, including whether responsive materials have been appropriately examined (e.g., 
examined for overproduction); 

H) (U//FOUO) Whether any Federal Grand Jury Materials covered by Rule 6e are properly 
marked and handled, including being appropriately restricted in the FBI’s central 
recordkeeping system; 

I) (U//FOUO) Whether the Watchlist status of any subject(s) has been appropriately 
documented; 

J) (U//FOUO) Whether the status of the Preliminary Investigation is current (e.g., has not 
expired or will not expire before the next file review); 

K) (U//FOUO) Whether any Potential Intelligence Oversight Board (IOB) violations have been 
reported in accordance with policy; 

L) (U//FOUO) Whether relevant asset forfeiture statutes have been applied and their use 
documented; 

M) (U//FOUO) Whether any intelligence in the investigation or Assessment resulted in the 
production of Intelligence Information Reports (IIRs) or Situational Information Reports 
(SIRs), and whether such reports were released to the intelligence/law enforcement 
community and properly documented in the INTELPRODS sub-file in compliance with the 
DIOG; 

N) (U//FOUO) Whether victim assistance policy has been followed (i.e., identification, 
notification to the Victim Specialist, documentation, case status updates, etc.) in compliance 
with the DIOG and the Victim Assistance Program Policy Implementation Guide [VAPPG]; 
and 
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O) (U//FOUO) Whether Crime Problem Indicator (CPI) codes for the investigation or 
Assessment were identified, complete and current in accordance with policy. 

(U//FOUO) Supervisors must evaluate the proper use of investigative methods and ensure 
they are appropriately documented in the file. Leads and administrative actions must be 
documented in ECs. When evidence has been obtained, the supervisor must ensure the 
evidence was treated and/or disposed of appropriately. The supervisor should use the file 
review process as an opportunity to determine whether the employee has adequately used 
liaison and external contacts to further the investigation/Assessment. In addition, the 
supervisor must assess whether the employee needs additional assistance, training, guidance, 
or other resources to successfully advance the investigation/Assessment. 

(U//FOUO) The intelligence aspect of every investigation must be scrutinized during the file 
review process. The supervisor must determine whether the employee understands his/her 
responsibilities relative to intelligence collection and reporting and has ensured that 
investigative and intelligence aspects of each investigation complement each other. This 
includes examining whether the employee has adequately collaborated with the field office’s 
intelligence component and exploited his/her investigations to obtain information relevant to 
standing intelligence collection requirements. The supervisor must review the files for 
potential intelligence collection and sharing opportunities, both cross-programmatic and 
interagency. The file review must document whether applicable intelligence products such as 
intelligence reports, bulletins and assessments, etc., have been or should be drafted based on 
investigative and intelligence information collected during the investigation. 

(U//FOUO) The supervisor must also evaluate whether the employee has been in 
communication with FBIHQ division entities, if appropriate, with respect to his/her 
investigative/intelligence activities. The supervisor must also evaluate whether the employee 
has coordinated with FBIHQ to obtain any special authorities/concurrences needed from 
DOJ/FBI components and other governmental agencies (e.g., CIA, DOS, and DOD). 

(U//FOUO) The supervisor must consider and take into account the employee’s collateral 
duties, such as SWAT, ERT, HAZMAT, Hostage Negotiator, training, TDY assignments and 
other activities constituting official business that could limit his/her ability to address his/her 
assigned caseload. The supervisor must take into account planned annual and sick leave, 
holidays and similar time constraints when estimating the employee’s overall work 
responsibilities for the next 90 day period. 

(U//FOUO) The supervisor must evaluate whether the employee is acting within all applicable 
statutes, regulations, and FBI/DOJ policies and procedures. Supervisors must keep in mind 
that how the employee accomplishes his or her tasks is just as important as whether he or she 
accomplishes them. Any compliance concerns must be immediately referred to the field 
office’s compliance officer for discussion regarding what additional actions should be taken. 
For specific requirements and procedures for reporting departures and non-compliance with 
the AGG-Dom and the DIOG, see Sections 2.6 - 2.8. 

(U//FOUO) At the conclusion of the file review, the supervisor must ensure that the employee 
understands the objectives to be accomplished over the next 90 calendar days and must 
document specifically those expectations on the file review sheets. At this time the supervisor 
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must also prepare an FD-865 (Performance Summary Assessment) for Special Agents. For all 
other employees, the supervisor has the option to prepare an FD-865. 

(U//FOUO) The supervisor must be diligent about documenting all aspects of the file review 
on the file review sheet and setting appropriate ticklers. 


3 .4.4. 7 (U) Type 1 & 2 Assessments - Justification Reviews 


(U//FOUO) Supervisors must conduct 3 0-day justification reviews for Type 1 & 2 
Assessments. Following the end of the 30-day period, the agent, TFO, or IA and the 
supervisor have up to 1 0 calendar days to complete all aspects of the just ification review and 
to document the reviewf 
71a) 


the Guardian (FD- 
Jfhese justification reviews must address the 


following Assessment Review Standards (ARS): 


A) (U//FOUO) has progress been made toward achieving the authorized purpose and clearly 
defined objective(s); 

B) (U//FOUO) were the activities that occurred in the prior 30 calendar days appropriate and in 
compliance with applicable DIOG requirements; 

C) (U//FOUO) is it reasonably likely that information will be obtained that is relevant to the 
authorized purpose and clearly defined objective(s), thereby warranting an extension for 
another 30 calendar days; 

D) (U//FOUO) has adequate predication been developed to open a Predicated Investigation; and 

E) (U//FOUO) should the Assessment be terminated. 


3.4.4.8 (U) Type 3, 4, and 6 Assessments - Assessment Review Standards (ARS) 

(U//FOUO) In addition to the file review procedures documented on the File Review Sheet set 
forth above, supervisors are required to evaluate Type 3, 4 and 6 Assessments (main file and 
all sub-files, or the 300A file associated with a Special Event Assessment) using the below- 
listed ARS during the file review every 90 calendar days (60 calendar days for probationary 
employees): 

A) (U//FOUO) has progress been made toward achieving the authorized purpose and clearly 
defined objective(s); 

B) (U//FOUO) were the activities that occurred in the prior 60 or 90 calendar days appropriate 
and in compliance with applicable DIOG requirements; 

C) (U//FOUO) is it reasonably likely that information may be obtained that is relevant to the 
authorized purpose and clearly defined objective(s), thereby warranting an extension for 
another 60/90 calendar days; 

D) (U//FOUO) has adequate predication been developed to open a Predicated Investigation on 
specific individuals identified during the Assessment; and 

E) (U//FOUO) should the Assessment be terminated. 

(U//FOUO) The ARS must be documented in an EC and serialized in the Assessment file. 
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(U//FOUO) The EC utilized to document the review of Type 3, 4 and 6 Assessments must be 
made part of the Assessment file. Therefore, the EC must not be used to memorialize other 
information, such as performance measures, investigative steps, possible outcomes, or 
compliance matters that are historically documented on the File Review Sheet. 


3.4.4.9 (U) Type 5 Assessments - Assessment Review Standards (ARS) 

(U//FOUO) The frequenc y of a supervisory file review must be in accordance with DIO G 
subsection 3.4.4.3. See the | 

] for specific Type 5 Assessment review standards and procedures. 


(U// FOUO) The T ype 5 Assessment file review must be documented in an EC or successor 
forml ]and serialized in the Assessment file. Because Type 5 Assessments are 


confidential, a File Review Sheet is not available to be generated from the FBI’s central 
recordkeeping system. 


(U//FOUO) The EC (or successor form 


utilized to document the evaluation of the 


ARSs for Type 5 Assessments m ust be made part of the Assessment file. Therefore, the EC 
(or successor form | must not be used to memorialize other information, such as 


performance measures, investigative steps, possible evaluation or recruitment outcomes, or 
compliance matters. 


3.4.4.10 (U) Documentation of File Reviews 

(U//FOUO) File Review Sheets may be generated by the FBI’s central recordkeeping system. 
These must be completed by the supervisor as part of the file review process and maintained 
as a part of the employee’s performance folder to be used as a tool in determining an 
employee’s performance rating. Documents maintained for evaluations, including copies of 
File Review Sheets, must be maintained or destroyed in accordance with the FBI’s 
performance appraisal system. See Corporate Policy Directive 0489D and Policy 
Implementation Guide 0489PG. The original File Review Sheets are to be maintained for 
inspection and other purposes not related to the performance appraisal process for a period of 
at least 2 years after created, or if related to a pending internal investigation, performance 
action, complaint, or charge, then one year from the date that case was closed, whichever is 
the longer period of time. 

(U//FOUO) Performance Summary Assessments (PSA) are required to be completed by the 
supervisor as part of the file review process. The FD-865 must be used to memorialize the 
PSA. The FD-865 is not required for use in the formal employee performance appraisal, but 
may complement the employee evaluation process. The last page of the form must be signed 
and dated by the employee and the supervisor. The employee must also initial the page(s) 
preceding the signature page. The original FD-865 must be submitted to the field office’s 
executive management, which is responsible for ensuring that PSAs are conducted. One 
completed copy of the FD-865 must be placed in the employee's performance folder 
maintained by the rating official for inspection, mid-year progress reviews, development 
worksheets, and annual performance appraisal purposes (this provision does not apply to 
TFOs). A second completed copy must be given to the employee. FD-865s maintained for 
performance evaluation must be destroyed in accordance with the FBI performance appraisal 
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system. For guidance on the FBI’s performance appraisal system, see Corporate Policy 
Directive 0489D and Policy Implementation Guide 0489PG~) . 

3.4.4.11 (U) Records Retention 

(U//FOUO) Supervisors must conduct, document and retain file reviews as specified above. 
Supervisors must maintain appropriate documentation and review it periodically with 
particular attention to documenting an employee’s ability to successfully complete his or her 
investigative assignments and to documenting a probationary employee’s success or failure 
during the probationary period. 

3.5 (U) Chief Division Counsel (CDC) Roles and Responsibilities 

(U//FOUO) The CDC must review all Assessments and Predicated Investigations involving 
Sensitive Investigative Matters (SIM) as discussed in DIOG Section 10 as well as review the use 
of certain investigative methods as discussed in Section 18. The primary purpose of the CDC’s 
review is to ensure the legality of the actions proposed. Review, in this context, includes a 
determination that the investigative activity is: (i) not legally objectionable (e.g., that it is not 
based solely on the exercise of First Amendment rights (i.e., the free exercise of speech, religion, 
assembly, press or petition) or on the race, ethnicity, national origin or religion of the subject); 
and (ii) founded upon an authorized purpose and/or adequate factual predication and meets the 
standard specified in the DIOG. The CDC should also include in his or her review and 
recommendation, if appropriate, a determination of the wisdom of the proposed action (e.g., the 
CDC may have no legal objection but may recommend denial because the value of the proposal 
is outweighed by the intrusion into legitimate privacy interests). The CDC’s determination that 
an investigative activity is: (i) not legally objectionable; and (ii) warranted from a mission 
standpoint is based on facts known at the time of the review and recommendation. Often, these 
facts are not verified or otherwise corroborated until the investigative activity commences. As a 
result, the CDC may require additional CDC reviews or provide guidance to supervisory 
personnel with regard to monitoring the results of the investigative activity to ensure that the 
authorized purpose and/or factual predication remains intact after the facts are developed. The 
regularity of such review is within the CDC’s discretion. Activities found to be legally 
objectionable by the CDC may not be approved unless and until the CDC’s determination is 
countermanded by the FBI General Counsel or a delegated designee. 

(U//FOUO) For investigative activities involving a SIM, the CDC must also independently 
consider the factors articulated in Section 10 and provide the approving authority with a 
recommendation as to whether, in the CDC’s judgment, the investigative activity should be 
approved. 

(U//FOUO) Throughout the DIOG, any requirement imposed on the CDC may be performed by 
an Associate Division Counsel (ADC) or a designated Acting CDC. 

3.6 (U) Office of the General Counsel (OGC) Roles and Responsibilities 

(U//FOUO) The mission of the FBI's Office of the General Counsel (OGC) is to provide 
comprehensive legal advice to the Director, other FBI officials and divisions, and field offices on 
a wide array of national security, investigative, and administrative operations. In addition to 
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providing legal advice as requested, OGC reviews the legal sufficiency of sensitive Title III 
affidavits and a wide variety of operational documents relating to foreign counterintelligence/ 
international terrorism investigations, including requests for surveillance and physical searches 
pursuant to the Foreign Intelligence Surveillance Act (FISA) and undercover proposals, and 
manages the physical flow of FISA requests, applications, orders, and returns. OGC maintains 
liaison with the intelligence community on legal issues and reviews for legal sufficiency 
proposals to share information or form partnerships with other federal, state, local, and 
international agencies. OGC also supports federal criminal prosecutions by assisting in criminal 
discovery and by conducting reviews of personnel files, coordinates the defense of the FBI and 
its employees in civil actions which arise out of the FBI's investigative mission and personnel 
matters, and responds to Congressional requests for FBI documents. OGC addresses legal issues 
associated with the impact of communication and information technology on the ability of the 
FBI and other law-enforcement and intelligence agencies to execute their public safety and 
national security missions, including their ability to conduct authorized electronic surveillance. 

(U//FOUO) In coordination with the DOJ NSD, the OGC is responsible for conducting regular 
reviews of all aspects of FBI national security and foreign intelligence activities. The primary 
purpose of the OGC’s review is to ensure the legality of the actions proposed. These reviews, 
conducted at FBI field offices and FBIHQ’ units, broadly examine such activities for compliance 
with the AGG-Dom and other applicable requirements. Review, in this context, includes a 
determination that the investigative activity is: (i) not legally objectionable (e.g., that it is not 
based solely on the exercise of First Amendment rights or on the race, ethnicity, national origin 
or religion of the subject); and (ii) founded upon an authorized purpose and/or adequate factual 
predication and meets the standard specified in the DIOG. The OGC should also include in its 
review and recommendation, if appropriate, a determination of the wisdom of the proposed 
action (e.g., the OGC may have no legal objection but may recommend denial because the value 
of the proposal is outweighed by the intrusion into legitimate privacy interests). The OGC’s 
determination that an investigative activity is: (i) not legally objectionable; and (ii) warranted 
from a mission standpoint is based on facts known at the time of the review and 
recommendation. Often these facts are not verified or otherwise corroborated until the 
investigative activity commences. As a result, the OGC may require additional OGC reviews or 
provide guidance to supervisory personnel with regard to monitoring the results of the 
investigative activity to ensure that the authorized purpose and/or factual predication remains 
intact after the facts are developed. The regularity of such review is within the discretion of 
OGC. 

(U//FOU0) For those investigative activities involving a sensitive investigative matter requiring 
OGC review, the OGC must independently consider the factors articulated in Section 10 and 
provide the approving authority with a recommendation as to whether, in the OGC’s judgment, 
the investigative activity should be approved. 

(U//FOUO) Throughout the DIOG, any requirement imposed on the General Counsel may be 
delegated and performed by a designated OGC attorney. All delegations must be made as set 
forth in Section 3.4.3 above. 
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3.7 (U) Corporate Policy Office (CPO) Roles and Responsibilities 

(U//FOUO) Subject to the guidance of the Deputy Director, the CPO has oversight of the 
implementation of the DIOG. Working with the Deputy Director’s office, the CPO may make 
revisions to the DIOG as necessary, following appropriate coordination with the OIC, OGC and 
other FBIHQ or field office entities. In the process of implementing and analyzing the DIOG, the 
CPO should report any apparent compliance risk areas directly to the OIC. Additionally, the 
CPO will work directly with the OIC to ensure that the policies, training and monitoring are 
adequate to meet compliance monitoring procedures. 

(U//FOUO) The CPO is responsible for ensuring the following: 

A) (U//FOUO) The DIOG is updated as necessary to comply with changes in the law, rules, or 
regulations; 

B) (U//FOUO) The DIOG is reviewed every three years from the effective date of the 2011 
revision, and revised as appropriate. This mandatory review schedule, however, does not 
restrict the CPO, which is responsible for all corporate policy matters, from working with 
FBIHQ divisions and field offices to make policy revisions to the DIOG and the PGs 
whenever necessary and appropriate during the three year period. The CPO may also make 
technical or non-substantive language or formatting changes to the DIOG, as necessary, 
provided those changes clarify the meaning without altering the substance; 

C) (U//FOUO) Existing and proposed investigative and administrative policies and PGs comply 
with the standards established in the AGG-Dom and DIOG. On behalf of the Deputy Director, 
the CPO has the authority, following coordination with the OIC and OGC, to modify or 
remove any provision of existing or proposed investigative or administrative policies or PGs 
determined to violate, contradict, or otherwise modify the intent or purpose of any provision 
or standard established in the AGG-Dom or the DIOG; and 

D) (U//FOUO) If the CPO makes any changes to the DIOG or other policy pursuant to 3.7.B 
and/or C above, the CPO will immediately advise by e-mail all FBIHQ and field office 
Division Policy Officers (DPO) of such changes and all DPO must further advise their 
respective FBI employees of such changes. The electronic version of the DIOG maintained in 
the CPO’s Policy and Guidance Library is the official current policy of the FBI. 

3.8 (U) Office of Integrity and Compliance (OIC) Roles and 
Responsibilities 

(U//FOUO) OIC is responsible for reviewing the DIOG and working with each FBIHQ division 
and the CPO to identify compliance risk areas and to ensure the adequacy of policy statements, 
training and monitoring. When compliance risk areas are identified, OIC must work with the 
divisions, field offices, and/or programs affected by the risk and develop programs to review the 
adequacy of policy statements, training, and monitoring in order to mitigate those concerns 
appropriately. 

3.9 (U) Operational Program Manager Roles and Responsibilities 

(U//FOUO) In addition to managing national level programs, coordinating investigations, 
training, and providing guidance and oversight to the field, the FBIHQ Operational Program 
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Managers are responsible for identifying, prioritizing, and analyzing potential compliance risks 
within their programs regarding implementation of the DIOG and developing mitigation plans 
where warranted. 

(U//FOUO) Operational Program Managers must proactively identify and take appropriate action 
to resolve potential compliance concerns. In identifying possible compliance concerns, Program 
Managers should consider the following indicators of possible compliance issues: 

A) (U//FOUO) Similar activities being handled differently from squad-to-squad / unit-to-unit / 
field office-to-field office; 

B) (U//FOUO) Unusually high level of contact with FBIHQ’ division for basic information on 
how to conduct an activity; 

C) (U//FOUO) Apparent confusion over how to conduct a certain activity; 

D) (U//FOUO) Policy conflict; 

E) (U//FOUO) Non-existent/inaccurate/wrongly targeted training; 

F) (U//FOUO) Monitoring mechanisms that do not exist or do not test the right information (e.g. 
file reviews/program management); and 

G) (U//FOUO) Inadequate processes in place to audit for compliance. 

(U//FOUO) Operational Program Managers may not retaliate or take adverse action against 
persons who raise compliance concerns . 

3.10 (U) Division Compliance Officer Roles and Responsibilities 

(U//FOUO) Each FBIHQ division and field office must have a Division Compliance Officer 
(DCO). The DCO will proactively identify potential risk of non-compliance in the 
implementation of the DIOG and report them to the proper authority and the OIC. The DCO 
must always be aware that the focus of a compliance program is the identification and resolution 
of a compliance problem using non-punitive and non-retaliatory means. 

3.11 (U) Position Equivalents - FBI Headquarters (FBIHQ) Approval 
Levels 

(U//FOUO) The official position equivalents between the field offices and FBIHQ are outlined 
below. In general, an equivalent position at either the field or FBIHQ may exercise DIOG 
authority, unless the DIOG specifically limits a given authority. The equivalent positions are: 

A) (U//FOUO) Field Office Analyst or Special Agent = FBIHQ Analyst or Special Agent; 

B) (U//FOUO) Field Office SIA = FBIHQ SIA; 

C) (U//FOUO) CDC = FBIHQ OGC General Attorney; 

D) (U//FOUO) Field Office SSA = FBIHQ SSA; 

E) (U//FOUO) Field Office ASAC = FBIHQ UC; 

F) (U//FOUO) SAC = FBIHQ SC; and 

G) (U//FOUO) ADIC = FBIHQ AD. 
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4 (U) PRIVACY AND CIVIL LIBERTIES, AND LEAST INTRUSIVE 

METHODS 


4.1 (U) Civil Liberties and Privacy 

4.1.1 (U) Overview 

(U) The FBI is responsible for protecting the security of our nation and its people from crime and 
terrorism while maintaining rigorous obedience to the Constitution. The Attorney General’s 
Guidelines for Domestic FBI Activities (AGG-Dom) establish a set of basic principles that serve 
as the foundation for all FBI mission-related activities. When these principles are applied, they 
demonstrate respect for civil liberties and privacy as well as adherence to the Constitution and 
laws of the United States. These principles are as follows: 

A) (U) Protecting the public includes protecting their rights and liberties. FBI investigative 
activity is premised upon the fundamental duty of government to protect the public, which 
must be performed with care to protect individual rights and to ensure that investigations are 
confined to matters of legitimate government interest. 

B) (U) Only investigate for a proper purpose. All FBI investigative activity must have an 
authorized law enforcement, national security, or foreign intelligence purpose. 

C) (U) Race, ethnicity, religion, or national origin alone can never constitute the sole basis 
for initiating investigative activity. Although these characteristics may be taken into account 
under certain circumstances, there must be an independent authorized law enforcement or 
national security purpose for initiating investigative activity. 

D) (U) Only perform authorized activities in pursuit of investigative objectives. Authorized 
activities conducted as part of a lawful assessment or investigation include the ability to: 
collect criminal and national security information, as well as foreign intelligence; provide 
investigative assistance to federal, state, local, tribal, and foreign agencies; conduct 
intelligence analysis and planning; and retain and share information. 

E) (U) Employ the least intrusive means that do not otherwise compromise FBI operations. 

Assuming a lawful intelligence or evidence collection objective, i.e., an authorized purpose, 
strongly consider the method (technique) employed to achieve that objective that is the least 
intrusive available (particularly if there is the potential to interfere with protected speech and 
association, damage someone’s reputation, intrude on privacy, or interfere with the 
sovereignty of foreign governments) while still being operationally sound and effective. 

F) (U) Apply best judgment to the circumstances at hand to select the most appropriate 
investigative means to achieve the investigative goal. The choice of which investigative 
method to employ is a matter of judgment, but the FBI must not hesitate to use any lawful 
method consistent with the AGG-Dom when the degree of intrusiveness is warranted in light 
of the seriousness of the matter concerned. 

4.1.2 (U) Purpose of Investigative Activity 

(U) One of the most important safeguards in the AGG-Dom — one that is intended to ensure that 
FBI employees respect the constitutional rights of Americans — is the threshold requirement that 
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all investigative activities be conducted for an authorized purpose. Under the AGG-Dom that 
authorized purpose must be an authorized national security, criminal, or foreign intelligence 
collection purpose. 

(U) Simply stating such a purpose, however, is not sufficient to ensure compliance with this 
requirement. The authorized purpose must be well-founded and well-documented. In addition, 
the information sought and the investigative method used to obtain it must be focused in scope, 
time, and manner to achieve the underlying purpose. Furthermore, the Constitution sets limits on 
what that purpose may be. It may not be solely to monitor the exercise of constitutional rights, 
such as the free exercise of speech, religion, assembly, press and petition, and, equally important, 
the authorized purpose may not be based solely on the race, ethnicity, national origin or religious 
beliefs of an individual, group, or organization or a combination of only those factors. 

(U) It is important to understand how the “authorized purpose” requirement and these 
constitutional limitations relate to one another. For example, individuals or groups who 
communicate with each other or with members of the public in any form in pursuit of social or 
political causes — such as opposing war or foreign policy, protesting government actions, or 
promoting certain religious beliefs — have a First Amendment right to do so. No investigative 
activity may be conducted for the sole purpose of monitoring the exercise of these rights. If a 
well-founded basis to conduct investigative activity exists, however, and that basis is not solely 
activity that is protected by the First Amendment or on the race, ethnicity, national origin or 
religion of the participants — FBI employees may assess or investigate these activities, subject to 
other limitations in the AGG-Dom and the DIOG. In such a situation, the investigative activity 
would not be based solely on constitutionally-protected conduct or on race, ethnicity, national 
origin or religion. Finally, although investigative activity would be authorized in this situation, it 
is important that it be conducted in a manner that does not materially interfere with the ability of 
the individuals or groups to engage in the exercise of constitutionally-protected rights. 

4.1.3 (U) Oversight and Self-Regulation 

(U) Every FBI employee has the responsibility to ensure that the activities of the FBI are lawful, 
appropriate and ethical as well as effective in protecting the civil liberties and privacy of 
individuals in the United States. Strong oversight mechanisms are in place to assist the FBI in 
carrying out this responsibility. Department of Justice (DOJ) oversight is provided through 
provisions of the AGG-Dom, other Attorney General Guidelines, and oversight by other DOJ 
components. DOJ and the FBI’s Inspection Division, and the FBI’s Office of Integrity and 
Compliance (OIC) and Office of the General Counsel (OGC), also provide substantial 
monitoring and guidance. In the criminal investigation arena, prosecutors and district courts 
exercise oversight of FBI activities. In the national security and foreign intelligence arenas, the 
DOJ National Security Division (NSD) exercises that oversight. The DOJ NSD’s Oversight 
Section and the FBI’s OGC are responsible for conducting regular reviews of all aspects of FBI 
national security and foreign intelligence activities. These reviews, conducted at FBI field offices 
and FBI Headquarters (FBIHQ) divisions, broadly examine such activities for compliance with 
the AGG-Dom and other applicable requirements. In addition, the AGG-Dom creates additional 
requirements, including: 

A) (U) Required notification by the FBI to the DOJ NSD concerning a Full Investigation that 
involves foreign intelligence collection, a Full Investigation of a United States person 
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(USPER) in relation to a threat to the national security, or a national security investigation 
involving a “sensitive investigative matter” (SIM) (see DIOG Section 10). 

B) (U) An annual report by the FBI to the DOJ NSD concerning the FBI’s foreign intelligence 
collection program, including information reflecting the scope and nature of foreign 
intelligence collection activities in each FBI field office. 

C) (U) Access by the DOJ NSD to information obtained by the FBI through national security or 
foreign intelligence activities. 

D) (U) General authority for the Assistant Attorney General for National Security to obtain 
reports from the FBI concerning these activities. (AGG-Dom, Intro. C) 

(U) Further examples of oversight mechanisms include the involvement of both FBI and 
prosecutorial personnel in the review of undercover operations involving sensitive 
circumstances; notice requirements for investigations involving sensitive investigative matters; 
and notice and oversight provisions for Enterprise Investigations, which involve a broad 
examination of groups implicated in criminal and national security threats. These requirements 
and procedures help to ensure that the rule of law is respected in the FBI’s activities and that 
public confidence is maintained in these activities. (AGG-Dom, Intro. C) 

(U) In addition to the above-described oversight mechanisms, the FBI is subject to a regime of 
oversight, legal limitations, and self-regulation designed to ensure strict adherence to the 
Constitution. This regime is comprehensive and has many facets, including the following: 

A) (U) The Foreign Intelligence Surveillance Act of 1978, as amended, and Title III of the 
Omnibus Crime Control and Safe Streets Act of 1968. These laws establish the processes for 
obtaining judicial approval of electronic surveillance and physical searches for the purpose of 
collecting foreign intelligence and electronic surveillance for the purpose of collecting 
evidence of crimes. 

B) (U) The Whistleblower Protection Acts of 1989 and 1998. These laws protect whistleblowers 
from retaliation. 

C) (U) The Freedom of Information Act of 1966. This law provides the public with access to FBI 
documents not covered by a specific statutory exemption. 

D) (U) The Privacy Act of 1974. This law balances the government's need to maintain 
information about United States citizens and legal permanent resident aliens with the rights of 
those individuals to be protected against unwarranted invasions of their privacy stemming 
from the government's collection, use, maintenance, and dissemination of that information. 
The Privacy Act forbids the FBI and other federal agencies from collecting information about 
how individuals exercise their First Amendment rights, unless that collection is expressly 
authorized by statute or by the individual, or is pertinent to and within the scope of an 
authorized law enforcement activity (5 U.S.C. § 552a[e][7]). Activities authorized by the 
AGG-Dom - with the exception of Positive Foreign Intelligence collection (see DIOG Section 
9.3) - are authorized law enforcement activities or activities for which there is otherwise 
statutory authority for purposes of the Privacy Act. 

E) (U) Documents describing First Amendment activity that are subsequently determined to have 
been collected or retained in violation of the Privacy Act must be destroyed as set forth in 
Records Management Division’s (RMD) policy, Handling of Information Gathered in 
Violation of the Privacy Act (Policy Directive 0356D). 
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(U) Congress, acting primarily through the Judiciary and Intelligence Committees, exercises 
regular, vigorous oversight into all aspects of the FBI’s operations. To this end, the National 
Security Act of 1947 requires the FBI to keep the intelligence committees (for the Senate and 
House of Representatives) fully and currently informed of substantial intelligence activities. This 
oversight has significantly increased in breadth and intensity since the 1970’s, and it provides 
important additional assurance that the FBI conducts its investigations according to the law and 
the Constitution. Advice on what activities fall within the supra of required congressional 
notification can be obtained from OCA [A Corporate Policy Directive is forthcoming]. 

(U) The FBI’s intelligence activities (as defined in Section 3.4(e) of Executive Order (EO) 12333 
[see DIOG Appendix B]) are subject to significant self-regulation and oversight beyond that 
conducted by Congress. The Intelligence Oversight Board (IOB), comprised of members from 
the President’s Intelligence Advisory Board (PIAB), also conducts oversight of the FBI’s 
intelligence activities. Among its responsibilities, the IOB must inform the President of 
intelligence activities the IOB believes: (i)(a) may be unlawful or contrary to EO or Presidential 
National Security Directive (PNSD), and (b) are not being adequately addressed by the Attorney 
General, the Director of National Intelligence (DNI), or the head of the department concerned; or 
(ii) should be immediately reported to the President. The requirements and procedures for 
reporting potential IOB matters to OGC/NSLB can be found in Corporate Policy Directive 
0188D (Guidance on IOB Matters), and the Policy Implementation Guide (PG) 0188PG . 

(U) Internal FBI safeguards include: 

A) (U) the OGC’s Privacy and Civil Liberties Unit (PCLU), which reviews plans for any 
proposed FBI record system for compliance with the Privacy Act and related privacy 
protection requirements and policies and which provides legal advice on civil liberties 
questions; 

B) (U) the criminal and national security undercover operations review committees, comprised of 
senior DOJ and FBI officials, which review all proposed undercover operations that involve 
sensitive circumstances; 

C) (U) the Sensitive Operations Review Committee (SORC), comprised of senior DOJ and 
FBI officials, which provides oversight of those investigative activities that may impact civil 
liberties and privacy and that are not otherwise subject to high level FBI and DOJ review; 

D) (U) the FBI requirement that all FBI employees report departures from and non-compliance 
with the DIOG to their supervisor, other management officials, or appropriate authorities as 
set forth in DIOG Sections 2.6 - 2.8 and 3.1.1; and 

E) (U) training new FBI employees on privacy and periodic training for all FBI employees to 
maintain currency on the latest guidelines, changes to laws and regulations, and judicial 
decisions related to constitutional rights and liberties. 

4.2 (U) Protection of First Amendment Rights 

(U) A fundamental principle of the Attorney General’s Guidelines for FBI investigations and 
operations since the first guidelines were issued in 1976 has been that investigative activity may 
not be based solely on the exercise of rights guaranteed by the First Amendment to the United 
States Constitution. This principle carries through to the present day in the AGG-Dom. The 
Privacy Act contains a corollary principle - the government is prohibited from retaining 
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information describing how a person exercises rights under the First Amendment, unless that 
information is pertinent to or within the scope of an authorized law enforcement activity. 5 
U.S.C. § 552a(e)(7). 

(U) The First Amendment states: 

(U) Congress shall make no law respecting an establishment of religion, or prohibiting 
the free exercise thereof; or abridging the freedom of speech, or of the press; or of the 
right of the people peaceably to assemble, and to petition the Government for a redress of 

grievances. 

(U) Although the amendment appears literally to apply only to Congress, the Supreme Court 
made clear long ago that it also applies to activities of the Executive Branch, including law 
enforcement agencies. Therefore, for FBI purposes, it would be helpful to read the introduction 
to the first sentence as: “The FBI shall take no action respecting...” In addition, the word 
“abridging” must be understood. “Abridging,” as used here, means “diminishing.” Thus, it is not 
necessary for a law enforcement action to destroy or totally undermine the exercise of First 
Amendment rights for it to be unconstitutional; significantly diminishing or lessening the ability 
of individuals to exercise these rights without an authorized investigative purpose is sufficient. 

(U) This is not to say that any diminution of First Amendment rights is unconstitutional. The 
Supreme Court has never held that the exercise of these rights is absolute. In fact, the Court has 
realistically interpreted the level and kind of government activity that violates a First 
Amendment right. For example, taken to an extreme, one could argue that the mere possibility of 
an FBI agent being present at an open forum (or as an on-line presence) would diminish the right 
of free speech by a participant in the forum because he/she would be afraid to speak freely. The 
Supreme Court, however, has never found an “abridgement” of First Amendment rights based on 
such a subjective fear. Rather, the Court requires an action that, from an objective perspective, 
truly diminishes the speaker’s message or his/her ability to deliver it (e.g., pulling the plug on the 
sound system). For another example, requiring protestors to use a certain parade route may 
diminish their ability to deliver their message in a practical sense, but the Court has made it 
clear, that for legitimate reasons (e.g., public safety), the government may impose reasonable 
limitations in terms of time, place and manner on the exercise of such rights, as long as the 
ability to deliver the message remains. 

(U) While the language of the First Amendment prohibits action that would abridge the 
enumerated rights, the implementation of that prohibition in the AGG-Dom reflects the Supreme 
Court’s opinions on the constitutionality of law enforcement action that may impact the exercise 
of First Amendment rights. As stated above, the AGG-Dom prohibits investigative activity for 
the sole purpose of monitoring the exercise of First Amendment rights. The importance of the 
distinction between this language and the actual text of the First Amendment is two-fold: (i) the 
line drawn by the AGG-Dom prohibits even “monitoring” the exercise of First Amendment 
rights (far short of abridging those rights) as the sole purpose of FBI activity; and (ii) the 
requirement of an authorized purpose for all investigative activity provides additional protection 
for the exercise of constitutionally protected rights. 

(U) The AGG-Dom classifies investigative activity that involves a religious or political 
organization (or an individual prominent in such an organization) or a member of the news 
media as a “sensitive investigative matter.” That designation recognizes the sensitivity of 
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conduct that traditionally involves the exercise of First Amendment rights by groups, e.g., who 
associate for political or religious purposes or by the press. The requirements for opening and 
pursuing a “sensitive investigative matter” are set forth in DIOG Section 10. It should be clear, 
however, from the discussion below just how pervasive the exercise of First Amendment rights 
is in American life and that not all protected First Amendment activity will fall within the 
definition of a “sensitive investigative matter.” Therefore, it is essential that FBI employees 
recognize when investigative activity may have an impact on the exercise of these fundamental 
rights and be especially sure that any such investigative activity has a valid law enforcement or 
national security purpose, even if it is not a “sensitive investigative matter” as defined in the 
AGG-Dom and the DIOG. 

(U) Finally, it is important to note that individuals in the United States (and organizations 
comprised of such individuals) do not forfeit their First Amendment rights simply because they 
also engage in criminal activity or in conduct that threatens national security. For example, an 
organization suspected of engaging in acts of domestic terrorism may also pursue legitimate 
political goals and may also engage in lawful means to achieve those goals. The pursuit of these 
goals through constitutionally protected conduct does not insulate them from legitimate 
investigative focus for unlawful activities — but the goals and the pursuit of their goak , through 
lawful means remain protected from unconstitutional infringement. 

(U) When allegations of First Amendment violations are brought to a court of law, it is usually in 
the form of a civil suit in which a plaintiff has to prove some actual or potential harm. See, e.g., 
Presbyterian Church v. United States, 870 F.2d 518 (9th Cir. 1989) (challenging INS 
surveillance of churches). In a criminal trial, a defendant may seek either or both of two remedies 
as part of a claim that his or her First Amendment rights were violated: suppression of evidence 
gathered in the alleged First Amendment violation, a claim typically analyzed under the 
“reasonableness” clause of the Fourth Amendment, and dismissal of the indictment on the basis 
of “outrageous government conduct” in violation of the Due Process Clause of the Fifth 
Amendment. 

(U) The scope of First Amendment rights and their impact on FBI investigative activity are 
discussed below. The First Amendment’s “establishment clause” — the prohibition against the 
government establishing or sponsoring a specific religion — has little application to the FBI and, 
therefore, is not discussed here. 

4.2.1 (U) Free Speech 

(U) The exercise of free speech includes far more than simply speaking on a controversial topic 
in the town square. It includes such activities as carrying placards in a parade, sending letters to a 
newspaper editor, posting information on the Internet, wearing a tee shirt with a political 
message, placing a bumper sticker critical of the President on one’s car, and publishing books or 
articles. The common thread in these examples is conveying a public message or an idea through 
words or deeds. Law enforcement activity that diminishes a person’s ability to communicate in 
any of these ways may interfere with his or her freedom of speech — and thus may not be 
undertaken by the FBI solely for that purpose. 

(U) It is important to understand the line between constitutionally protected speech and advocacy 
of violence or of conduct that may lead to violence or other unlawful activity. In Brandenburgy. 
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Ohio, 395 U.S. 444 (1969), the Supreme Court established a two-part test to determine whether 
such speech is constitutionally protected: the government may not prohibit advocacy of force or 
violence except when such advocacy (i) is intended to incite imminent lawless action, and (ii) is 
likely to do so. Therefore, even heated rhetoric or offensive provocation that could conceivably 
lead to a violent response in the future is usually protected. Suppose, for example, a politically 
active group advocates on its web site taking unspecified “action” against persons or entities it 
views as the enemy, who thereafter suffer property damage and/or personal injury. Under the 
Brandenburg two-part test, the missing specificity and imminence in the message may provide it 
constitutional protection. For that reason, law enforcement may take no action that, in effect, 
blocks the message or punishes its sponsors. 

(U) Despite the high standard for interfering with free speech or punishing those engaged in it, 
the law does not preclude FBI employees from observing and collecting any of the forms of 
protected speech and considering its content — as long as those activities are done for a valid law 
enforcement or national security purpose and are conducted in a manner that does not unduly 
infringe upon the ability of the speaker to deliver his or her message. To be an authorized 
purpose it must be one that is authorized by the AGG-Dom — i.e. to further an FBI Assessment, 
Predicated Investigation, or other authorized function such as providing assistance to other 
agencies. Furthermore, by following the standards for opening or approving an Assessment or 
Predicated Investigation as contained in the DIOG, the FBI will ensure that there is a rational 
relationship between the authorized purpose and the protected speech to be collected such that a 
reasonable person with knowledge of the circumstances could understand why the information is 
being collected. 

(U) Returning to the example posed above, because the group’s advocacy of action could be 
directly related by circumstance to property damage suffered by one of the group’s known 
targets, collecting the speech — although constitutionally protected — can lawfully occur. 

Similarly, listening to and documenting the public talks by a religious leader, who is suspected of 
raising funds for a terrorist organization, may yield clues as to his motivation, plan of action, 
and/or hidden messages to his followers. FBI employees should not, therefore, avoid collecting 
First Amendment protected speech if it is relevant to an authorized AGG-Dom purpose — as long 
as FBI employees do so in a manner that does not inhibit the delivery of the message or the 
ability of the audience to hear it, and so long as the collection is done in accordance with the 
discussion of least intrusive means or method in Section 4.4. 

(U) In summary, during the course of lawful investigative activities, the FBI may lawfully 
collect, retain, and consider the content of constitutionally protected speech, so long as: (i) the 
collection is logically related to an authorized investigative purpose; (ii) the collection does not 
actually infringe on the ability of the speaker to deliver his or her message; and (iii) the method 
of collection complies with the least intrusive method policy. 

4.2.2 (U) Exercise of Religion 

(U) Like the other First Amendment freedoms, the “free exercise of religion” clause is broader 
than commonly believed. First, it covers any form of worship of a deity — even forms that are 
commonly understood to be cults or fringe sects, as well as the right not to worship any deity. 
Second, protected religious exercise also extends to dress or food that is required by religious 
edict, attendance at a facility used for religious practice (no matter how unlikely it appears to be 
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intended for that purpose), observance of the Sabbath, raising money for evangelical or 
missionary purposes, and proselytizing. Even in controlled environments like prisons, religious 
exercise must be permitted — subject to reasonable restrictions as to time, place, and manner. 
Another feature of this First Amendment right is that religion is a matter of heightened 
sensitivity to some Americans — especially to devout followers. For this reason, religion is a 
matter that is likely to provoke an adverse reaction if the right is violated — regardless of which 
religion is involved. Therefore, when essential investigative activity may impact this right, the 
investigative activity must be conducted in a manner that avoids the actual — and the appearance 
of — interference with religious practice to the maximum extent possible. 

(U) While there must be an authorized purpose for any investigative activity that could have an 
impact on religious practice, this does not mean religious practitioners or religious facilities are 
completely free from being examined as part of an Assessment or Predicated Investigation. If 
such practitioners are involved in — or such facilities'are used for — activities that are the proper 
subject of FBI-authorized investigative or intelligence collection activities, their religious 
affiliation does not “immunize” them to any degree from these efforts. It is paramount, however, 
that the authorized purpose of such efforts be properly documented. It is also important that 
investigative activity directed at religious leaders or at conduct occurring within religious 
facilities be focused in time and manner so as not to infringe on legitimate religious practice by 
any individual but especially by those who appear unconnected to the activities under 
investigation. 

(U) Furthermore, FBI employees may take appropriate cognizance of the role religion may play 
in the membership or motivation of a criminal or terrorism enterprise. If, for example, affiliation 
with a certain religious institution or a specific religious sect is a known requirement for 
inclusion in a violent organization that is the subject of an investigation, then whether a person of 
interest is a member of that institution or sect is a rational and permissible consideration. 
Similarly, if investigative experience and reliable intelligence reveal that members of a terrorist 
or criminal organization are known to commonly possess or exhibit a combination of religion- 
based characteristics or practices (e.g., group leaders state that acts of terrorism are based in 
religious doctrine), it is rational and lawful to consider such a combination in gathering 
intelligence about the group — even if any one of these, by itself, would constitute an 
impermissible consideration. By contrast, solely because prior subjects of an investigation of a 
particular group were members of a certain religion and they claimed a religious motivation for 
their acts of crime or terrorism, other members’ mere affiliation with that religion, by itself, is 
not a basis to assess or investigate — absent a known and direct connection to the threat under 
Assessment or investigation. Finally, the absence of a particular religious affiliation can be used 
to eliminate certain individuals from further investigative consideration in those scenarios where 
religious affiliation is relevant. 

4.2.3 (U) Freedom of the Press 

(U) Contrary to what many believe, this well-known First Amendment right is not owned by the 
news media; it is a right of the American people. Therefore, this right covers such matters as 
reasonable access to news-making events, the making of documentaries, and various other forms 
of publishing the news. Although the news media typically seek to enforce this right, freedom of 
the press should not be viewed as a contest between law enforcement or national security, on the 
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one hand, and the interests of news media, on the other. That said, the news gathering function is 
the aspect of freedom of the press most likely to intersect with law enforcement and national , 
security investigative activities. 

(U) The interest of the news media in protecting confidential sources and the interest of agencies 
like the FBI in gaining access to those sources who may have evidence of a crime or national 
security intelligence often clash. The seminal case in this area is Branzburg v. Hayes, 408 U.S. 
665 (1972), in which the Supreme Court held that freedom of the press does not entitle a news 
reporter to refuse to divulge the identity of his source to a federal grand jury. The Court reasoned 
that, as long as the purpose of law enforcement is not harassment or vindictiveness against the 
press, any harm to the news gathering function of the press (by revealing source identity) is 
outweighed by the need of the grand jury to gather evidence of crime. 

(U) Partially in response to Branzburg, the Attorney General promulgated regulations that 
govern the issuance of subpoenas for reporter’s testimony and telephone toll records, the arrest 
of a reporter for a crime related to news gathering, and the interview of a reporter as a suspect in 
a crime arising from the news gathering process. In addition, an investigation of a member of the 
news media in his official capacity, the use of a reporter as a source, and posing as a member of 
the news media are all sensitive circumstances in the AGG-Dom, DIOG and other applicable 
AGGs. 

(U) These regulations are not intended to insulate reporters and other news media from FBI 
Assessments or Predicated Investigations. They are intended to ensure that investigative activity 
that seeks information from or otherwise involves members of the news media: 

A) (U) Is appropriately authorized; 

B) (U) Is necessary for an important law enforcement or national security objective; 

C) (U) Is the least intrusive means to obtain the information or achieve the goals; and 

D) (U) Does not unduly infringe upon the news gathering aspect of the constitutional right to 
freedom of the press. 

4.2.4 (U) Freedom of Peaceful Assembly and to Petition the Government 

for Redress of Grievances 

(U) Freedom of peaceful assembly, often called the right to freedom of association, presents 
unique issues for law enforcement agencies, including the FBI. Individuals who gather with 
others to protest government action, or to rally or demonstrate in favor of, or in opposition to, a 
social cause sometimes present a threat to public safety by their numbers, by their actions, by the 
anticipated response to their message, or by creating an opportunity for individuals or other 
groups with an unlawful purpose to infiltrate and compromise the legitimacy of the group for 
their own ends. The right to peaceful assembly includes more than just public demonstrations — it 
includes, as well, the posting of group web sites on the Internet, recruiting others to a cause, 
marketing a message, and fund raising. All are protected First Amendment activities if they are 
conducted in support of the organization or political, religious or social cause. 

(U) The right to petition the government for redress of grievances is so linked to peaceful 
assembly and association that it is included in this discussion. A distinction between the two is 
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that an individual may exercise the right to petition the government by himself whereas assembly 
necessarily involves others. The right to petition the government includes writing letters to 
Congress, carrying a placard outside city hall that delivers a political message, recruiting others 
to one’s cause, and lobbying Congress or an executive agency for a particular result. 

(U) For the FBI, covert presence or action within associations or organizations, also called 
“undisclosed participation,” has the greatest potential to impact this constitutional right. The 
Supreme Court addressed this issue as a result of civil litigation arising from one of the many 
protests against the Vietnam War. In Laird v. Tatum, 408 U.S. 1 (1972), the Court found that the 
mere existence of an investigative program — consisting of covert physical surveillance in public 
areas, infiltration of public assemblies by government operatives or sources, and the collection of 
news articles and other publicly available information — for the purpose of determining the 
existence and scope of a domestic threat to national security does not, by itself, violate the First 
Amendment rights of the members of the assemblies. The subjective “chill” to the right to 
assembly, based on the suspected presence of government operatives, did not by itself give rise 
to legal “standing” for plaintiffs to argue that their constitutional rights had been abridged. 
Instead, the Court required a showing that the complained-of government action would 
reasonably deter the exercise of that right. 

(U) Since Laird v. Tatum was decided, the lower courts have examined government activity on 
many occasions to determine whether it gave rise to a “subjective chill” or an “objective 
deterrent.” The basic standing requirement establish by Laird remains unchanged today. The 
lower courts, however, have often imposed a very low threshold of objective harm to survive a 
motion to dismiss the case. For example, plaintiffs who have shown a loss of membership in an 
organization, loss of financial support, loss to reputation and status in the community, and loss of 
employment by members have been granted standing to sue. 

(U) More significant for the FBI than the standing issue has been the lower courts’ evaluation of 
investigative activity into First Amendment protected associations since Laird. The courts have 
held the following investigative activities to be constitutionally permissible under First 
Amendment analysis: 

A) (U) Undercover participation in group activities; 

B) (U) Physical and video surveillance in public areas; 

C) (U) Properly authorized electronic surveillance; 

D) (U) Recruitment and operation of sources; 

E) (U) Collection of information from government, public, and private sources (with consent); 
and 

F) (U) The dissemination of information for a valid law enforcement purpose. 

(U) However, these decisions were not reached in the abstract. In every case in which the courts 
have found government action to be proper, the government proved that the action was 
conducted for an authorized law enforcement or national security purpose and that the action was 
conducted in substantial compliance with controlling regulations. In addition, in approving these 
techniques, the courts have often considered whether a less intrusive technique was available to 
the agency, and the courts have balanced the degree of intrusion or impact against the importance 
of the law enforcement or national security objective. 
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(U) By contrast, since Laird, the courts have found these techniques to be legally objectionable: 

A) (U) Opening an investigation solely because of the group’s social or political agenda (even if 
the agenda made the group susceptible to subversive infiltration); 

B) (U) Sabotaging or neutralizing the group’s legitimate social or political agenda; 

C) (U) Disparaging the group’s reputation or standing; 

D) (U) Leading the group into criminal activity that otherwise probably would not have 
occurred; and 

E) (U) Undermining legitimate recruiting or funding efforts. 

(U) In every such case, the court found the government’s purpose was not persuasive, was too 
remote, or was too speculative to justify the intrusion and the potential harm to the exercise of 
First Amendment rights. 

(U) Once again, the message is clear that investigative activity that involves assemblies or 
associations of individuals in the United States exercising their First Amendment rights must 
have an authorized purpose under the AGG-Dom — and one to which the information sought and 
the technique to be employed are rationally related. Less intrusive techniques should always be 
explored first and those authorizing such activity (which, as discussed above, will almost always 
constitute a sensitive investigative matter) should ensure that the investigative activity is focused 
as narrowly as feasible and that the purpose is thoroughly documented. 

4.3 (U) Equal Protection under the Law 

4.3.1 (U) Introduction 

(U) The Equal Protection Clause of the United States Constitution provides in part that: “No 
State shall make or enforce any law which shall deny to any person within its jurisdiction the 
equal protection of the laws.” The Supreme Court and the lower courts have made it clear that 
the Equal Protection Clause applies to the official acts of United States government law 
enforcement agents. See, e.g., Whren v. United States, 517 U.S. 806 (1996); see also Chavez v. 
Illinois State Police, 251 F.3d 612 (7th Cir. 2001). 

Specifically, government employees are prohibited from engaging in invidious discrimination 
against individuals on the basis of race, ethnicity, national origin, or religious affiliation. This 
principle is further reflected and implemented for federal law enforcement in the United States 
Department of Justice’s Guidance Regarding the Use of Race bv Federal LlM. Enforcement 
Agencies (hereinafter “DOJ Guidance on the Use of Race”). 

(U) Investigative and intelligence collection activities must not be based solely on race, ethnicity, 
national origin, or religious affiliation. Any such activities that are based solely on such 
considerations are invidious by definition, and therefore, unconstitutional. This standard applies 
to all investigative and collection activity, including collecting and retaining information, 
opening investigations, disseminating information, and indicting and prosecuting defendants. It 
is particularly applicable to the retention and dissemination of personally identifying information 
about an individual — as further illustrated in the examples enumerated below. 
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(U) The constitutional prohibition against invidious discrimination based on race, ethnicity, 
national origin or religion is relevant to both the national security and criminal investigative 
programs of the FBI. National security investigations often have ethnic aspects; members of a 
foreign terrorist organization may be primarily or exclusively from a particular country or area of 
the world. Similarly, ethnic heritage is frequently the common thread running through violent 
gangs or other criminal organizations. It should be noted that this is neither a new nor isolated 
phenomenon. Ethnic commonality among criminal and terrorist groups has been relatively 
constant and widespread across many ethnicities throughout the history of the FBI. 

4.3.2 (U) Policy Principles 

(U) To ensure that Assessment and investigative activities and strategies consider facial, ethnic, 
national origin and religious factors properly and effectively and to help assure the American 
public that the FBI does not engage in invidious discrimination, the DIOG establishes the 
following policy principles: 

A) (U) The prohibition on basing investigative activity solely on race or ethnicity is not avoided 
by considering it in combination with other prohibited factors. For example, a person of a 
certain race engaging in lawful public, speech about his religious convictions is not a proper 
subject of investigative activity based solely on any one of these factors — or by their 
combination. Before collecting and using information on race, religion or other prohibited 
factors, a well-founded and authorized investigative purpose must exist beyond these 
prohibited factors. 

B) (U) When race or ethnicity is a relevant factor to consider, it should not be the dominant or 
primary factor. Adherence to this standard will not only ensure that it is never the sole 
factor — it will also preclude undue and unsound reliance on race or ethnicity in investigative 
analysis. It reflects the recognition that there are thousands and, in some cases, millions of law 
abiding people in American society of the same race or ethnicity as those who are the subjects 
of FBI investigative activity, and it guards against the risk of sweeping them into the net of 
suspicion without a sound investigative basis. 

C) (U) The FBI will not collect or use behavior or characteristics common to a particular racial or 
ethnic community as investigative factors unless the behavior or characteristics bear clear and 
specific relevance to a matter under Assessment or investigation. This policy is intended to 
prevent the potential that collecting ethnic characteristics or behavior will inadvertently lead to 
individual identification based solely on such matters, as well as to avoid the appearance that 
the FBI is engaged in ethnic or racial profiling. 

4.3.3 (U) Guidance on the Use of Race and Ethnic Identity in Assessments 
and Predicated Investigations 

(U) Considering the reality of common ethnicity or race among many criminal and terrorist 
groups, some question how the prohibition against racial or ethnic profiling is to be effectively 
applied — and not violated — in FBI Assessments and Predicated Investigations. The question 
arises generally in two contexts: (i) with respect to an individual or a group of individuals; and 
(ii) with respect to ethnic or racial communities as a whole. 
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4.3.3. 1 (U) Individual Race or Ethnicity as a Factor 

(U) The DOJ Guidance on the Use of Race permits the consideration of ethnic and racial 
identity information based on specific reporting — such as from an eyewitness. As a general 
rule, race or ethnicity as an identifying feature of a suspected perpetrator, subject, and in some 
cases, a victim, is relevant if it is based on reliable evidence or information — not conjecture or 
stereotyped assumptions. In addition, the DOJ Guidance on the Use of Race permits 
consideration of race or ethnicity in other investigative or collection scenarios if it is relevant. 
These examples illustrate: 

A) (U) The race or ethnicity of suspected members, associates, or supporters of an ethnic-based 
gang or criminal enterprise may be collected and retained when gathering information about or 
investigating the organization. 

B) (U) Ethnicity may be considered in evaluating whether a subject is — or is not — a possible 
associate of a criminal or terrorist group that is known to be comprised of members of the 
same ethnic grouping — as long as it is not the dominant factor for focusing on a particular 
person. It is axiomatic that there are many members of the same ethnic group who are not 
members of the criminal or terrorist group; for that reason, there must be other information 
beyond race or ethnicity that links the individual to the terrorist or criminal group or to the 
other members of the group. Otherwise, racial or ethnic identity would be the sole criterion, 
and that is impermissible. 

4.3.3.2 (U) Community Race or Ethnicity as a Factor 

4.3.3.2.1 (U) Collecting and Analyzing Demographics 

(U) The DOJ Guidance on the Use of Race and FBI policy permit the FBI to identify 
locations of concentrated ethnic communities in the field office’s domain, if these locations 
will reasonably aid the analysis of potential threats and vulnerabilities, and, overall, assist 
domain awareness for the purpose of performing intelligence analysis. If, for example, 
intelligence reporting reveals that members of certain terrorist organizations live and operate 
primarily within a certain concentrated community of the same ethnicity, the location of that 
community is clearly valuable — and properly collectible — data. Similarly, the locations of 
ethnic-oriented businesses and other facilities may be collected if their locations will 
reasonably contribute to an awareness of threats and vulnerabilities, and intelligence 
collection opportunities. Also, members of some communities may be potential victims of 
civil rights crimes and, for this reason, community location may aid enforcement of civil 
rights laws. Information about such communities should not be collected, however, unless the 
communities are sufficiently concentrated and established so as to provide a reasonable 
potential for intelligence collection that would support FBI mission programs (e.g., where 
identified terrorist subjects from certain countries may relocate to blend in and avoid 
detection). 


43.3.2.2 (U) Geo-Mapping Ethnic/Racial Demographics 

(U) As a general rule, if information about community demographics may be collected, it may 
be “mapped.” Sophisticated computer geo-mapping technology visually depicts lawfully 
collected information and can assist in showing relationships among disparate data. By itself, 
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mapping raises no separate concerns about racial or ethnic profiling, assuming the underlying 
information that is mapped was properly collected. It may be used broadly - e.g., for domain 
awareness of all relevant demographics in the field office’s area of responsibility or to track 
crime trends - or narrowly to identify specific communities or areas of interest to inform a 
specific Assessment or investigation. In each case, the relevance of the ethnic or racial 
information mapped to the authorized purpose of the Assessment or investigation must be 
clearly demonstrated and documented. 

4.3.3.23 (U) General Ethnic/Racial Beha vior 

(U) The authority to collect ethnic community location information does not extend to the 
collection of cultural and behavioral information about an ethnic community that bears no 
rational relationship to a valid investigative or analytical need. Every ethnic community in the 
Nation that has been associated with a criminal or national security threat has a dominant 
majority of law-abiding citizens, resident aliens, and visitors who may share common ethnic 
behavior but who have no connection to crime or terrorism (as either subjects or victims). For 
this reason, a broad-brush collection of racial or ethnic characteristics or behavior is not 
helpful to achieve any authorized FBI purpose and may create the appearance of improper 
racial or ethnic profiling. 

4.33.2.4 (U) Specific and Relevant Ethnic Behavior 

(U) On the other hand, knowing the behavioral and life style characteristics of known 
individuals who are criminals or who pose a threat to national security may logically aid in 
the detection and prevention of crime and threats to the national security within the 
community and beyond. Focused behavioral characteristics reasonably believed to be 
associated with a particular criminal or terrorist element of an ethnic community (not with the 
community as a whole) may be collected and retained. For example, if it is known through 
intelligence analysis or otherwise that individuals associated with an ethnic-based terrorist or 
criminal group conduct their finances by certain methods, travel in a certain manner, work in 
certain jobs, or come from a certain part of their home country that has established links to 
terrorism, those are relevant factors to consider when investigating the group or assessing 
whether it may have a presence within a community. It is recognized that the “fit” between 
specific behavioral characteristics and a terrorist or criminal group is unlikely to be perfect — 
that is, there will be members of the group who do not exhibit the behavioral criteria as well 
as persons who exhibit the behaviors who are not members of the group. Nevertheless, in 
order to maximize FBI mission relevance and to minimize the appearance of racial or ethnic 
profiling, the criteria used to identify members of the group within the larger ethnic 
community to which they belong must be as focused and as narrow as intelligence reporting 
and other circumstances permit. If intelligence reporting is insufficiently exact so that it is 
reasonable to believe that the criteria will include an unreasonable number of people who are 
not involved, then it would be inappropriate to use the behaviors, standing alone, as the basis 
for FBI activity. 
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43.3.2.5 (U) Exploitive Ethnic Behavior 

(U) A related category of information that can be collected is behavioral and cultural 
information about ethnic or racial communities that is reasonably likely to be exploited by 
criminal or terrorist groups who hide within those communities in order to engage in illicit 
activities undetected. For example, the existence of a cultural tradition of collecting funds 
from members within the community to fund charitable causes in their homeland at a certain 
time of the year (and how that is accomplished) would be relevant if intelligence reporting 
revealed that, unknown to many donors, the charitable causes were fronts for terrorist 
organizations or that terrorist supporters within the community intended to exploit the 
unwitting donors for their own purposes. 

4.4 (U) Least Intrusive Method 

4.4.1 (U) Overview 

(U) The AGG-Dom requires that the "least intrusive" means or method be considered and — if 
reasonable based upon the circumstances of the investigation — used to obtain intelligence or 
evidence in lieu of a more intrusive method. This principle is also reflected in See Appendix B: 
Executive Order 12333, which governs the activities of the United States Intelligence 
Community. The concept of least intrusive method applies to the collection of all information. 
Regarding the collection of foreign intelligence that is not collected as part of the FBI’s 
traditional national security or criminal missions, the AGG-Dom further requires that open and 
overt collection activity must be used with USPERs, if feasible. 

(U) By emphasizing the use of the least intrusive means to obtain information, FBI employees 
can effectively execute their duties while mitigating potential negative impact on the privacy and 
civil liberties of all people encompassed within the investigation, including targets, witnesses, 
and victims. This principle is not intended to discourage FBI employees from seeking relevant 
and necessary information, but rather is intended to encourage investigators to choose the least 
intrusive — but still reasonable — means from the available options to obtain the information. 

(U) This principle is embodied in statutes and DOJ policies on a variety of topics including 
electronic surveillance, the use of tracking devices, the temporary detention of suspects, and 
forfeiture. In addition, the concept of least intrusive method can be found in case law as a factor 
to be considered in assessing the reasonableness of an investigative method in the face of a First 
Amendment or due process violation claim. See Clark v. Library of Congress, 750 F.2d 89, 94-5 
(D.C. Cir. 1984); Alliance to End Repression v. City of Chicago, 627 F. Supp. 1044, 1055 (N.D. 
111. 1985), citing Elrod v. Burns, 427 U.S. 347, 362-3 (1976). 

4.4.2 (U) General Approach to Least Intrusive Method Concept 

(U) Determining what constitutes the least intrusive method in an investigative or intelligence 
collection scenario is both a logical process and an exercise in judgment. It is logical in the sense 
that the FBI employee must first confirm that the selected technique will: 

A) (U) Gather information that is relevant to the Assessment or Predicated Investigation; 
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B) (U) Acquire the information within the time frame required by the assessment or Predicated 
Investigation; 

C) (U) Gather the information consistent with operational security and the protection of sensitive 
sources and methods; and 

D) (U) Gather information in a manner that provides confidence in its accuracy. 

(U) Determining the least intrusive method also requires sound judgment because the factors 
discussed above are not fixed points on a checklist. They require careful consideration based on a 
thorough understanding of investigative objectives and circumstances. 

4.4.3 (U) Determining Intrusiveness 

(U) The degree of procedural protection that established law and the AGG-Dom provide for the 
use of the method helps to determine its intrusiveness. Using this factor, search warrants, 
wiretaps, and undercover operations are very intrusive. By contrast, investigative methods with 
limited procedural requirements, such as checks of government and commercial data bases and 
communication with established sources, are less intrusive. 

(U) The following guidance is designed to assist FBI personnel in judging the relative 
intrusiveness of different methods: 

A) (U) Nature of the information sought: Investigative objectives generally dictate the type of 
information required and from whom it should be collected. This subpart is not intended to 
address the situation where the type of information needed and its location are so clear that 
consideration of alternatives would be pointless. When the option exists to seek information 
from any of a variety of places, however, it is less intrusive to seek information from less 
sensitive and less protected places. Similarly, obtaining information that is protected by a 
statutory scheme (e.g., financial records) or an evidentiary privilege (e.g., attomey/client 
communications) is more intrusive than obtaining information that is not so protected. In 
addition, if there exists a reasonable expectation of privacy under the Fourth Amendment (i.e., 
private communications), obtaining that information is more intrusive than obtaining 
information that is knowingly exposed to public view as to which there is no reasonable 
expectation of privacy. 

B) (U) Scope of the information sought: Collecting information regarding an isolated event — 
such as a certain phone number called on a specific date or a single financial transaction — is 
less intrusive or invasive of an individual's privacy than collecting a complete communications 
or financial "profile." Similarly, a complete credit history is a more intrusive view into an 
individual's life than a few isolated credit charges. In some cases, of course, a complete 
financial and credit profile is exactly what the investigation requires (for example, 
investigations of terrorist financing or money laundering). If so, FBI employees should not 
hesitate to use appropriate legal process to obtain such information if the predicate 
requirements are satisfied. Operational security — such as source protection — may also dictate 
seeking a wider scope of information than is absolutely necessary for the purpose of protecting 
a specific target or source. When doing so, however, the concept of least intrusive method still 
applies. The FBI may obtain more data than strictly needed, but it should obtain no more data 
than is needed to accomplish the investigative or operational security purpose. 

C) (U) Scope of the use of the method: Using a method in a manner that captures a greater 
picture of an individual’s or a group's activities are more intrusive than using the same method 
or a different one that is focused in time and location to a specific objective. For example, it is 
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less intrusive to use a tracking device to verify point-to-point travel than it is to use the same 
device to track an individual’s movements over a sustained period of time. Sustained tracking 
on public highways would be just as lawful but more intrusive because it captures a greater 
portion of an individual's daily movements. Similarly, surveillance by closed circuit television 
that checks a discrete location within a discrete time frame is less intrusive than 24/7 coverage 
of a wider area. For another example, a computer intrusion device that captures only host 
computer identification information is far less intrusive than one that captures file content. 

D) (U) Source of the information sought: It is less intrusive to obtain information from existing 
government sources (such as state, local, tribal, international, or federal partners) or from 
publicly-available data in commercial data bases, than to obtain the same information from a 
third party (usually through legal process) that has a confidential relationship with the 
subject — such as a financial or academic institution. Similarly, obtaining information from a 
reliable confidential source who is lawfully in possession of the information and lawfully 
entitled to disclose it (such as obtaining an address from an employee of a local utility 
company) is less intrusive than obtaining the information from an entity with a confidential 
relationship with the subject. It is recognized in this category that the accuracy and procedural 
reliability of the information sought is an important factor in choosing the source of the 
information. For example, even if the information is available from a confidential source, a 
grand jury subpoena, national security letter, ex parte order, or other process may be required 
in order to ensure informational integrity and accuracy. 

E) (U) The risk of public exposure: Seeking information about an individual or group under 
circumstances that create a risk that the contact itself and the information sought will be 
exposed to the individual's or group's detriment and/or embarrassment — particularly if the 
method used carries no legal obligation to maintain silence — is more intrusive than 
information gathering that does not carry that risk. Interviews with employers, neighbors, and 
associates, for example, or the issuance of grand jury subpoenas at a time when the 
investigation has not yet been publicly exposed are more intrusive than methods that gather 
information covertly. Similarly, interviews of a subject in a discrete location would be less 
intrusive than an interview at, for example, a place of employment or other location where the 
subject is known. 

(U) There is a limit to the utility of this list of intrusiveness factors. Some factors may be 
inapplicable in a given investigation and, in many cases, the choice and scope of the method will 
be dictated wholly by investigative objectives and circumstances. The foregoing is not intended 
to provide a comprehensive checklist or even an overall continuum of intrusiveness. It is 
intended instead to identify the factors involved in a determination of intrusiveness and to attune 
FBI employees to select, within each applicable category, a less intrusive method if operational 
circumstances permit. In the end, selecting the least intrusive method that will accomplish the 
objective is a matter of sound judgment. In exercising such judgment, however, consideration of 
these factors should ensure that the decision to proceed is well founded. 

4.4.4 (U) Standard for Balancing Intrusion and Investigative 

Requirements 

(U) Once an appropriate method and its deployment have been detennined, reviewing and 
approving authorities should balance the level of intrusion against investigative requirements. 
This balancing test is particularly important when the information sought involves clearly 
established constitutional, statutory, or evidentiary rights or sensitive circumstances (such as 
obtaining information from religious or academic institutions or public fora where First 
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Amendment rights are being exercised), but should be applied in all circumstances to ensure that 
the least intrusive method if reasonable based upon the circumstances of the investigation is 
being utilized. 

(U) Balancing the factors discussed above with the considerations discussed below will help 
determine whether the method and the extent to which it intrudes into privacy or threatens civil 
liberties are proportionate to the significance of the case and the information sought. 

(U) Considerations on the investigative side of the balancing scale include the: 

A) (U) Seriousness of the crime or national security threat; 

B) (U) Strength and significance of the intelligence/information to be gained; 

C) (U) Amount of information already known about the subject or group under investigation; and 

D) (U) Requirements of operational security, including protection of sources and methods. 

(U) If, for example, the threat is remote, the individual's involvement is speculative, and the 
probability of obtaining probative information is low, intrusive methods may not be justified, 
and, in fact, they may do more harm than good. At the other end of the scale, if the threat is 
significant and possibly imminent (e.g., a bomb threat), aggressive measures would be 
appropriate regardless of intrusiveness. 

(U) In addition, with respect to the investigation of a group, if the terrorist or criminal nature of 
the group and its membership is well established (e.g., al Qaeda, Ku Klux Klan, Colombo Family 
of La Cosa Nostra), there is less concern that pure First Amendment activity is at stake than there 
would be for a group whose true character is not yet known (e.g., an Islamic charity suspected of 
terrorist funding) or many of whose members appear to be solely exercising First Amendment 
rights (anti-war protestors suspected of being infiltrated by violent anarchists). This is not to 
suggest that investigators should be less aggressive in determining the true nature of an unknown 
group that may be engaged in terrorism or other violent crime. Indeed, a more aggressive and 
timely approach may be in order to determine whether the group is violent or to eliminate it as a 
threat. Nevertheless, when First Amendment rights are at stake, the choice and use of 
investigative methods should be focused in a manner that minimizes potential infringement of 
those rights. Finally, as the investigation progresses and the subject's or group's involvement 
becomes clear, more intrusive methods may be justified. Conversely, if reliable information 
emerges refuting the individual's involvement or the group's criminal or terrorism connections, 
the use of any investigative methods must be carefully reconsidered. 

(U) Another consideration to be balanced is operational security: if a less intrusive but 
reasonable method were selected, would the subject detect its use and alter his activities — 
including his means of communication — to thwart the success of the operation? Operational 
security — particularly in national security investigations — should not be undervalued and may, 
by itself, justify covert tactics which, under other circumstances, would not be the least intrusive. 

4.4.5 (U) Conclusion 

(U) The foregoing guidance is offered to assist FBI employees in navigating the often unclear 
course to select the least intrusive investigative method that effectively accomplishes the 
operational objective at hand. In the final analysis, choosing the method that must appropriately 
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balances the impact on privacy and civil liberties with operational needs, is a matter of judgment, 
based on training and experience. Pursuant to the AGG-Dom, other applicable laws and policies, 
and this guidance, FBI employees may use any lawful method allowed, even if intrusive, where 
the intrusiveness is warranted by the threat to the national security or to potential victims of 
crime and/or the strength of the information indicating the existence of that threat. 
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5 (U) ASSESSMENTS 


5.1 (U) Overview and Activities Authorized Prior to Opening an 

Assessment 

(U//FOUO) The AGG-Dom combines “threat assessments” under the former Attorney General’s 
Guidelines for FBI National Security Investigations and Foreign Intelligence Collection and the 
“prompt and extremely limited checking out of initial leads” under the former Attorney 
General’s Guidelines on General Crimes, Racketeering Enterprise and Terrorism Enterprise 
Investigations into a new investigative category entitled “Assessments.” 

(U//FOUO) All Assessments must be documented in the appropriate form, to include an FD- 
71 (until its functions are absorbed by Guardian), Guardian (FD-71a), or EC, and the form must 
be placed in one of the following files: 

A) (U//FOUO) investigative classification as an Assessment file (e.g., 415A-WF-xxxxxx); 

B) (U//FOUO~) zero sub-assessment file (e.g.. 91-0-ASSESS-D; 15-0-ASSESS; 315-0-ASSESS- 

D); ~ 

C) (U//FOUO) zero classification file (e.g. 196-WF-O). This file may be used if information is 
entered in the FD-71 or FD-71a and an Assessment is not opened based on that information; 

D) (U//FOUO) 800 series (801-807) classification file , as discussed in greater detail below; 

E) (U//FOUO) unaddressed, work file : or 

F) (U//FOUO') existing open or closed file . 

(U//FOUO) Note : In the DIOG, the word “assessment” has two distinct meanings. The AGG- 
Dom authorizes as an investigative activity an “Assessment,” which requires an authorized 
purpose as discussed in this section of the DIOG. The USIC, however, also uses the word 
“assessment” to describe written intelligence products, as discussed in DIOG Sections 15.2.3 and 
15.6.1.2. 

(U) Assessments authorized under the AGG-Dom do not require a particular factual predication 
but do require an authorized purpose and clearly defined objective(s). Assessments may be 
carried out to detect, obtain information about, or prevent or protect against Federal crimes or 
threats to the national security or to collect foreign intelligence. (AGG-Dom, Part II and Part 
II.A) 

(U//FOUO) Although “no particular factual predication” is required^ the basis of an Assessment 
cannot be arbitrary or groundless speculation, nor can an Assessment be based solely on the 
exercise of First Amendment protected activities or on the race, ethnicity, national origin or 
religion of the subject. Although difficult to define, “no particular factual predication” is less 
than “information or allegation” as required for the initiation of a preliminary investigation (PI). 
For example, an Assessment may be conducted when: (i) there is reason to collect information or 
facts to determine whether there is a criminal or national security threat; and (ii) there is a 
rational and articulable relationship between the stated authorized purpose of the Assessment on 
the one hand and the information sought and the proposed means to obtain that information on 
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the other. An FBI employee must be able to explain the authorized purpose and the clearly 
defined objective(s), and reason the particular investigative methods were used to conduct the 
Assessment. FBI employees who conduct Assessments are responsible for ensuring that 
Assessments are not pursued for frivolous or improper purposes and are not based solely on First 
Amendment activity or on the race, ethnicity, national origin, or religion of the subject of the 
Assessment, or a combination of only such factors. (AGG-Dom, Part II) 

(U//FOUO) When employees undertake activities authorized in DIOG Section 5. 1.1 below prior 
to opening an Assessment they must have a reason to undertake these activities that is tied to an 
authorized FBI criminal or national security purpose. 

5.1.1 (U) Activities Authorized Prior to Opening an Assessment 

(U//FOUO) When initially processing a complaint, observation, or information, an FBI employee 
can use the following investigative methods: 

5.1.1.1 (U) Public Information 

(U//FOUO) See DIOG section 18.5.1 . 

(U//FOUO) Prior to opening an Assessment, consent searches are not authorized. However, if 
in the course of processing a complaint or conducting a clarifying interview of the 
complainant, the complainant volunteers to provide access to his personal or real property, an 
agent may accept and conduct a search of the item(s) or property voluntarily provided. 

5.1.1.2 (U) Records or Information - FBI and DOJ 

(U//FOUO) See DIOG section 18.5.2 . 

5.1.1.3 (U) Records or Information - Other federal, state, local, tribal, or 

FOREIGN GOVERNMENT AGENCY 
(U//FOUO) See DIOG Section 18.5.3 . 

5.1.1.4 (U) On-line Services and Resources 

(U//FOUO) See DIOG Section 18.5.4. 

5.1.1.5 (U) Clarifying Interview 

(U//FOUO) Conduct a voluntary clarifying interview of the complainant or the person who 
initially furnished the information. 

(U//FOUO) See DIOG Section 18.5.6 . 

5.1.1.6 (U) Information Voluntarily Provided by Governmental or Private 
Entities 

(U//FOUO) See DIOG Section 18.5.7 . 


Version Dated: 
October 15, 2011 


5-2 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 



UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide §5 

(U//FOUO) With the benefit of a clarifying interview, checking records (existing/historical 
information), and/or asking an existing CHS about something that he or she already knows, an 
FBI employee may be able to answer the following question when evaluating the initial 
complaint, observation, or information: Does the complaint, observation, or information appear 
to represent a credible basis to open an Assessment, with an authorized purpose and clearly 
defined objective(s), or to open a Predicated Investigation consistent with the standards set forth 
in the DIOG? 

(U//FOUO) These activities may allow the FBI employee to resolve a matter without the need to 
conduct new investigative activity, for which an Assessment or a Predicated Investigation must 
be opened. When conducting clarifying interviews and checking records as described above, FBI 
employees must always adhere to the core values and principles articulated in DIOG Sections 3 
and 4. 


5.1.2 (U) Documentation Requirements for Activities Authorized Prior to 
Opening an Assessment: (Existing /historical information referred 
TO IN SECTION 5.1.1 ABOVE) 

(U//FOUO) FBI employees must document and retain records checks in an FD-71, FD-71a or 
successor intake form or other system of records if, in the judgment of the FBI employee, there is 
a law enforcement, intelligence or public safety purpose to do so. If such record checks, or other 
DIOG 5.1.1 permitted activities, are documented, they must also be retained in one of the 
following files: 

A) (U//FOUO) zero classification file when no further investigative activity is warranted; 

B) (U//FOUO) relevant open or closed zero sub-assessment file; 

C) (U//FOUO) relevant open or closed Predicated Investigation file; 

D) (U//FOUO) new Assessment or Predicated Investigation file, when further investigative 
activity is warranted; or 

E) (U//FOUO) unaddressed work file. 

U//FOUO) Intelligence Analysis and Planning: Through analysis of existing information, the 
FBI employee may produce products that include, but are not limited to: an Intelligence 
Assessment, Intelligence Bulletin and Geospatial Intelligence (mapping). If, while conducting 
analysis, the FBI employee finds a gap in intelligence that is relevant to an authorized FBI 
activity, then the FBI employee can identify the gap for possible development of a “collection 
requirement.” The FBI employee must document this analysis in the applicable 801-807 
classification file (or other 800-series classification file as directed in the Intelligence Policy 
Implementation Guide (IPG)). See the IPG for file classification guidance. 

5.1.3 (U) Liaison Activities and Tripwires 

(U) Some FBI activities are not traditional investigative or intelligence activities. Activities such 
as liaison, tripwires, and other community outreach represent relationship-building efforts or 
other pre-cursors to developing and maintaining good partnerships. These activities are critical to 
the success of the FBI’s mission. DIOG Section 1 1 addresses liaison activities and tripwires. 
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5.2 (U) Purpose and Scope 


(U//FOUO) The FBI cannot be content to wait for leads to come in through the actions of others; 
rather, we must be vigilant in detecting criminal or national security threats to the full extent 
permitted by law, with an eye towards early intervention and prevention of criminal or national 
security incidents before they occur. For example, to carry out the central mission of protecting 
the national security, the FBI must proactively collect information from available sources in 
order to identify threats and activities and to inform appropriate intelligence analysis. Collection 
required to inform such analysis will appear as FBI National Collection Requirements and FBI 
Field Office Collection Requirements. Likewise, in the exercise of its protective functions, the 
FBI is not constrained to wait until information is received indicating that a particular event, 
activity or facility has drawn the attention of would-be perpetrators of crime or terrorism. The 
proactive authority conveyed to the FBI is designed for, and may be used by, the FBI in the 
discharge of these responsibilities. The FBI may also conduct Assessments as part of its special 
events management responsibilities. (AGG-Dom, Part II) 

(U) More broadly, detecting and interrupting criminal activities at their early stages, and 
preventing crimes from occurring in the first place, is preferable to allowing criminal plots to 
come to fruition. Hence, Assessments may also be undertaken proactively with such purposes as 
detecting criminal activities; obtaining information on individuals, groups, or organizations of 
possible investigative interest, either because they may be involved in criminal or national 
security-threatening activities or because they may be targeted for attack or victimization in such 
activities; and identifying and assessing individuals who may have value as confidential human 
sources. (AGG-Dom, Part II and AGG-CHS) . 

(U//FOUO) As described in the scenarios below, Assessments may be used when an “allegation 
or information” or an “articulable factual basis” (the predicates for Predicated Investigations) 
concerning crimes or threats to the national security is obtained and the matter can be checked 
out or resolved through the relatively non-intrusive methods authorized in Assessments (use of 
least intrusive means). The checking of investigative leads in this manner can avoid the need to 
proceed to more elevated levels of investigative activity (Predicated Investigation), if the results 
of an Assessment indicate that further investigation is not warranted. (AGG-Dom, Part II) 
Hypothetical fact patterns are discussed below: 

5.2.1 (U) Scenarios 
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(U//FOTJO) 


5.3 (U) Civil Liberties and Privacy 

(U) The pursuit of legitimate goals without infringing upon the exercise of constitutional 
freedoms is a challenge that the FBI meets through the application of sound judgment and 
discretion. In order to ensure civil liberties are not infringed upon through Assessments, every 
Assessment must have an authorized purpose and clearly defined objective(s). The authorized 
purpose and clearly defined objective(s) of the Assessment must be documented and retained as 
described in this section and in DIOG Section 14. 

(U) Even when an authorized purpose is present, an Assessment could create the appearance that 
it is directed at or activated by constitutionally-protected activity, race, ethnicity, national origin 
or religion — particularly under circumstances where the link to an authorized FBI mission is not 
readily apparent. In these situations, it is vitally important that the authorized purpose and the 
clearly defined objective(s), as well as the use of any investigative methods, are well 
documented. 

(U) No investigative activity, including Assessments, may be taken solely on the basis of 
activities that are protected by the First Amendment or on the race, ethnicity, national origin .or 
religion of the subject, or a combination of only such factors. If an Assessment touches on or is 
partially motivated by First Amendment activities, or by race, ethnicity, national origin or 
religion, or a combination of only such factors, it is particularly important to identify and 
document the basis for the Assessment with clarity. 

(U//FOUO) Example : Individuals or groups who communicate with each other or with members 
of the public in any form in pursuit of social or political causes — such as opposing war or foreign 
policy, protesting government actions, promoting certain religious beliefs, championing 
particular local, national, or international causes, or advocating a change in government through 
non-criminal means, and actively recruiting others to join their causes — have a fundamental 
constitutional right to do so. An Assessment may not be opened based solely on the exercise of 
these First Amendment rights. If, however, a group exercising its First Amendment rights also 
threatens or advocates violence or destruction of property, an Assessment would be appropriate. 

(U) The AGG-Dom require that the "least intrusive" means or method be considered and — if 
reasonable based upon the circumstances of the investigation — used in lieu of more intrusive 
methods to obtain information, intelligence and/or evidence. This principle is also reflected in 
Executive Order 12333 (see Appendix B), which governs the activities of the USIC. Executive 
Order 12333 lays out the goals, directions, duties and responsibilities of the USIC. The concept 
of least intrusive means applies to the collection of all information, intelligence and evidence, not 
just that collected by those aspects of the FBI that are part of the intelligence community. 

(U) By emphasizing the use of the least intrusive means to obtain information, intelligence, 
and/or evidence, FBI employees can effectively execute their duties while mitigating the 
potential negative impact on the privacy and civil liberties and the damage to the reputation of all 
people encompassed within the investigation or Assessment, including targets, witnesses, and 
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victims. This principle is not intended to discourage FBI employees from seeking relevant and 
necessary intelligence, information, or evidence, but rather is intended to encourage FBI 
employees to choose the least intrusive — but still reasonable based upon the circumstances of the 
investigation — means from the available options to obtain the information. (AGG-Dom, Part 
I.C.2) 

5.4 (U) Five Types of Assessments (AGG-Dom, Part II.A.3.) 

5.4.1 (U) Assessment Types 

(U) There are five (5) authorized types of Assessments that may be carried out for the purposes 
of detecting, obtaining information about, or preventing or protecting against Federal crimes or 
threats to the national security or to collect foreign intelligence. The types of Assessments are: 

A) (U) Type 1&_2 Assessment : Seek information, proactively or in response to investigative 
leads, relating to activities - or the involvement or role of individuals, groups, or organizations 
relating to those activities - constituting violations of Federal criminal law or threats to the 
national security; 

B) (U) Type 3 Assessment : Identify, obtain and utilize information about actual or potential 
national security threats or Federal criminal activities, or the vulnerability to such threats or 
activities; 

C) (U) Type 4 Assessment : Obtain and retain information to inform or facilitate intelligence 
analysis and planning; 

D) (U) Type 5 Assessment : Seek information to identify potential human sources, assess their 
suitability, credibility, or value of individuals as human sources; and 

E) (U) Type 6 Assessment : Seek information, proactively or in response to investigative leads, 
relating to matters of foreign intelligence interest responsive to foreign intelligence 
requirements. 

5.5 (U) Standards for Opening or Approving an Assessment 

(U//FOUO) Before opening or approving an Assessment, an FBI employee or approving official 
must determine whether: 

A) (U//FOUO) An authorized purpose and clearly defined objective(s) exists for the conduct of 
the Assessment; 

B) (U//FOUO) The Assessment is not based solely on the exercise of First Amendment activities 
or on the race, ethnicity, national origin or religion of the subject, or a combination of only 
such factors; and 

C) (U//FOUO) The Assessment is an appropriate use of personnel and financial resources. 


4 (U//FOUO) In the original DIOG (12/16/2008), types I and 2 were considered to be separate Assessment types. 
Because they, however, have many commonalities, they were merged into one type (named a “Type 1 & 2 
Assessment”) for purposes of this version of the DIOG. Hence, there are now five, not six, types of Assessments. 
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5.6 (U) Position Equivalents, Effective Date, Duration, Documentation, 

Approval, Notice, File Review and Responsible Entity 

5. 6 . 1 (U) Field Office and FBIHQ Position Equivalents 

(U//FOUO) FBIHQ and FBI field offices have the authority to conduct all Assessment activities 
as authorized in Section 5.4 above. Position equivalents for field office and FBIHQ personnel 
when FBIHQ opens, conducts, or closes an Assessment are specified in DIOG Section 3.11. 

5.6.2 (U) Effective Date of Assessments 

(U//FOUO) For all Assessments, the effective date of the Assessment is the date the final 
approval authority approves the FD-71, Guardian (FD-71a) or EC. Documenting the effective 
date of an Assessment is important for many reasons, including establishing time frames for 
justification and file reviews, and extensions. The effective date of the final approval authority 
occurs when: 

A) (U//FOUO) For Type 1 & 2 Assessments : the SSA or SIA opens and assigns the FD-71 or 
Guardian (FD-71 a) to the employee. N ote: 1 

I [ he Guardian (FD-71 a)| 

I |and the electronic FD-7 II I ' 


(U//FOUO) Note: In Type 1 & 2 Assessments only, employees do not need to obtain 
supervisory approval prior to opening the Assessment. If, however, oral approval is obtained, 
employees must memorialize the oral approval date in the body of the FD-71 or Guardian 
(FD-7 la). 

B) (U//FOUO) For Type 3-6 Assessments: the SSA, SIA, or the DI opens and assigns the 
Assessmen t! 

|or (ii) handwriting his/her initials and date on the EC; or 

C) (U//FOUO) For Sensitive Investigative Matters ('SIM) Assessments : t he SAC (or SC) 
authorizes the Assessment to be opened and assigned to an FBI employee! 

FD-71 or Guardian ('FD-7 la) 

| (iii) handwriting his/her initials and date on the EC that is 
subsequently scanned ana serialized into the file. (See DIOG Sections 5.7 and 10). 

5. 6.3 (U) Assessment Types 

(U//FOUO) The applicable duration, documentation, approval level, notice, justification/file 
review, and responsible entity requirements for each of the five (5) types of Assessments are 
discussed below. 

(U//FOUO) In all types of Assessments, investigative leads, either Action Required or 
Information Only, may only be set by Lead Request form, EC, FD-71 or Guardian (FD-7 la). 

5.6.3.1 (U) Type 1 & 2 Assessments 

(U) Type 1 & 2 Assessment defined : Seek information, proactively or in response to 
investigative leads, relating to activities - or the involvement or role of individuals, 
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groups, or organizations in those activities - constituting violations of Federal criminal 
law or threats to the national security (i.e., the prompt checking of leads on individuals, 
activity, groups or organizations). 

(U//FOUO) See Section 5.11 below for intelligence collection (i.e.. incidental collection! and 
documentati on requirements ! 


5.6.3.1.1 (U) Duration 

(U//FOUO) There is no time limit for a Type 1 & 2 Assessment, but it is anticipated that such 
Assessments will be relatively short. 


5.6.3.1.2 (U) Documentation 


{uy/FouoJ 


Tthe FD-71 or Guardian. The Guardian (FD-71 a) 



(U//FOUO)! 


1 FD-71. Guardian (TD-71af 



71, in Guardian (FD-71 a). 


The completed FD-71, 


Guardian (FD-71 a), or Assessment opening communication requires supervisor approval 
before being serialized. 


(U//F0U01 



FD-71, Guardian (FD-71 a' 

LJ 


FD-71, Guardian (FD-71 a) 


UI//FOTIQ1 


5.6.3.1.3 (U) Approval to Open 


aDDroval.1 



FD-71, Guardian (FD-71 a) 
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. l theFD-71. Guardian| 

[The opening date for Type 1 & 2 Assessments is the 

date the SSA or SLA assigns an FBI employee to conduct the Assessment. The FBI employee 
and SSA or SIA must apply the standards for opening or approving a Type 1 & 2 Assessment 
contained in DIOG Section 5.5. 

5.6.3.1.4 (U) Sensitive Investigative Matters (SIM) 

(U//FOUO) As soon as practicable, but not more than five (5) business days after determining 
the Type 1 & 2 Assessment involves a sensitive investigative matter (SIM), the matter must 
be reviewed by the CDC and approved by the SAC. The term “sensitive inv estigative matter” 
is defined in DIOG Section 5.7 and DIOG Section 10. The FD-71. Guardian I I 


5.6.3.1.5 (U) Notice 

(U//FOUO) There is no requirement to provide notice to FBIHQ or DOJ of opening or closing 
Type 1 & 2 Assessments. 

5.6.3.1.6 (U) Justification Review 


(U//FOUO) If a Type 1 & 2 Assessment is not concluded within 30 days, the SSA or SIA 
must conduct a justification review e very 30 days (recurring until the Assessment is closed') in 
accord ance with DIOG Section 3.4.4.I 


]Guardian (FD-71 a), in an EC 


[ 


guidance in DIOG Section 5.6.2 above] 


Ivofe: Per 


] Guardian (FD-71 a). 


5.6.3.1.7 (U) Responsible Entity 


(U//FOUO) A Type 1 & 2 Assessment may be conducted by an investigative field office 
squad or FBIHQ operational division. 

5.6.3. 1.8 (U) Examples/Scenarios of Type 1&2 Assessments 


5.6.3. 1.8.1 (U) Example 1 


(U//FOUOf 


□ 


(U//FOUO) 


b7E 


b7E 


b7E 


b7E 


b7E 
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(U//FOUO) The FBI employee can conduct record checks (search FBI/ DOJ records, 
USIC records, anv other US government records, state or local records!, and Internet 
searches 


P ee 

Section 5.1.1) If an employee does not establish an authorized purpose to open an 
Assessment (or Predicated Investigation) after conducting these records checks or 
Internet searches, the FBI employee should refer to Section 5.1.2 above for documenting 
these activities. 


(U//FQUo[ 


and complete an FD-71, or Assessment opening communication. 


5.6.3. 1.8.2 (U) Example 2 


(U//FOUO)| 


(UZ/FOUpf 


b7E 


b7E 


b7E 


b7E 


b7E 
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5.6.3.2 (U) Type 3 Assessments 

(U) Type 3 Assessment defined : Identify, obtain and utilize information about actual or 
potential national security threats or Federal criminal activities, or the vulnerability to 
such threats or activities. [See AGG-Dom, Part ILA.3.b] 

(U//FOUO) Type 3 Assessments may be used to analyze or determine whether particular 
national security or criminal threats exist within the AOR and whether there are victims or 
targets within the AOR who are vulnerable to any such actual or potential threats. The 
authorized purpose and clearly defined objective(s) of a Type 3 Assessment must be based on 
or related to actual or potential Federal criminal or national security targets, threats, or 
vulnerabilities. While no particular factual predication is required, the basis of the Assessment 
cannot be arbitrary or groundless speculation, nor can the Assessment be based solely on the 
exercise of First Amendment protected activities or on race, ethnicity, national origin or 
religion, or a combination of only such factors. 

(U//FOUO) Whenever a Type 3 Assessment identifies and begins to focus on a specific 
individual(s), group(s) or organization(s), whose activities may constitute a violation of 
Federal criminal law or a threat to the national security, a separate Type 1 & 2 Assessment or 
a Predicated Investigation must be opened on that individual, group or organization. 

(U//FOUO) A Type 3 Assessment may not be opened based solely upon the existence of a 
collection requirement, and addressing a collection requirement cannot be the authorized 
purpose of a Type 3 Assessment. Information obtained during the course of this type of 
assessment (or any other Assessment or Predicated Investigation) may, however, be 
responsive to collection requirements and collection requirements may be used to inform and 
help focus a Type 3 Assessment (or any other Assessment or Predicated Investigation) while 
also providing information about potential targets, threats and/or vulnerabilities. 

(U//FOUOI Investigative activity undertaken durinsl 

[nust be documented usin g a Type 3 Assessment opened under the designated 

b pening a Type 3 Assessment for these events does 
not eliminate the requirement to use the 300A case classification as a non-investigative 
control file for administrative and logistical functions related to th ^ 

(U//FOUO) Note: Investigative activity cannot be serialized or maintained in the 300A 
classification file used for Special Event Assessments. Additionally, the 300A, non- 
investigative file, is subject to the periodic file review requirements described in DIOG 
Section 3.4.4. 


(U//FOUO) A Type 3 Assessment may not be used for the purpose of collecting positive 
foreign intelligence, although such intelligence may be incidentally collected. Positive foreign 
intelligence can only be intentionally collected pursuant to DIOG Sections 5.6.3.5 (Type 6 
Assessment) and/or Section 9. 


(U//FOUO) See Section 5.11 
documentat ion requirements, 


below for intelligence collection, fi.e.. incidental collection) and 


b7E 
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5.6.3.2.1 (U) Duration 

(U//FOUO) A Type 3 Assessment may only be opened with prior supervisor approval. The 
effective date of the Assessment is the date the final approval authority approves the EC as 
specified in Section 5.6.2 above. A Type 3 Assessment may continue for as long as necessary 
to achieve its authorized purpose and clearly defined objective(s). Although a Type 3 
Assessment is not limited in duration, when the clearly defined objective(s) have been met, 
the Assessment must be closed with an EC approved by the supervisor. 

5.6.3.2.2 (U) Documentation 

tU//FOUOll I 


tU//FOUOlf 


(U//FOUOf 


5. 6.3.2. 3 (U) Approval 

(U//FOUO) All Type 3 Assessments must be approved in advance by a supervisor and opened 
by EC. Notwithstanding any other provision in the DIOG, a Type 3 Assessment cannot be 
opened based on oral approval. The supervisor must review and approve a Type 3 Assessment 
in accordance with the standards set forth in Section 5.5. Additional approval requirements 
apply to SIMs, as described below. 

5.6.3.2A (U) Sensitive Investigative Matters (SIM) 

(U//FOUO) If the Assessment involves a sensitive investigative matter, the CDC must review 
and the SAC must approve the Assessment prior to opening. If a SIM arises after the opening 
of a Type 3 Assessment, Assessment activity may continue, but the matter must be 
documented in an EC reviewed by the CDC and approved by the SAC as soon as practicable 
but not more than five (5) business days after the SIM arises. The term “sensitive 
investigative matter” is defined in DIOG Sections 5.7.1 and Section 10. 
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(U//FOUO) Investigative methods that may be used in Assessments are set forth in DIOG 
Section 18. 

(U//FOUO) As specified in division PGs, there may be agreements (e.g., Memoranda of 
Understanding, Treaties) that require additional coordination and approval prior to conducting 
certain activities. 

5.63.2.5 (U) Notice 

(U//FOUO) There is no requirement to provide notice to FBIHQ or DOJ of opening or closing 
Type 3 Assessments. 

5.63.2.6 (U) File Review 

(U//FOUO) A Type 3 Assessment requires file reviews in accordance with DIOG Section 
3.4.4. 


5. 6.3.2. 7 (V) Responsible Entity 

(U//FOUO) A Type 3 Assessment may be opened and conducted by FIGs, the DI, a DI 
sponsored entity, field office investigative squads, and FBIHQ operational divisions. The 
nature of the Assessment dictates the file classification into which the Type 3 Assess ment is 
opened. Assessments conducted by the DI, or FIGs must be opened in the appropriat d I 

All other Type 3 Assessments must be opened in the 

appropriate investigative file classification. 

5.63.2.8 (U) Examples of Type 3 Assessments 


5.6.3.2.8.1 (U) Example 1 



(U//FOUOJ 
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5.6.3.2.8.2 (U) Example 2 



CU//FOUO 


_l 
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(U//FOUO] 


(U//FOUO; 


5.6.3 .2. 8.5 (U) Example 5 

(U//FOUO)| 


(U//FOUOII 


5.6.3. 3 (U) Type 4 Assessments 

(U) Type 4 Assessment defined ; Obtain and retain information to inform or facilitate 
intelligence analysis and planning. [AGG-Dom, Part IV] 

(U//FOUO) A Type 4 Assessment may be opened to obtain information that informs or 
facilitates the FBI’s intelligence analysis and planning functions. The authorized purpose and 
clearly defined objective(s) of a Type 4 Assessment must be based on, or related to, the need 
to collect or acquire information for current or future intelligence analysis and planning 
purposes. An Assessment under this section, oftentimes referred to as a “domain 
Assessment,” may lead to the identification of intelligence gaps, the development of FBI 
collection requirements, or the opening of new Assessments or Predicated Investigations. 

(U//FOUO) A Type 4 Assessment is not threat specific; threat-based Assessments are opened 
and governed by DIOG Section 5.6.3.2 (Type 3 Assessment). While no particular factual 
predication is required for a Type 4 Assessment, the Assessment cannot be based solely on 
the exercise of First Amendment protected activities or on race, ethnicity, national origin or 
religion, or a combination of only such factors. 

(U//FOUO) Whenever a Type 4 Assessment identifies and begins to focus on specific 
individual(s), group(s), or organization(s), whose activities may constitute a violation of 


b7E 


b7E 
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Federal criminal law or a threat to the national security, a separate Type 1 & 2 Assessment or 
a Predicated Investigation must be opened. Similarly, if a Type 4 Assessment identifies a 
particular national security or criminal threat within the AOR, or identifies victims or targets 
within an AOR who are vulnerable to any actual or potential threat, a separate Type 3 
Assessment or Predicated Investigation must be opened. 

(U//FOUO) A Type 4 Assessment may not be used for the purpose of collecting positive 
foreign intelligence (PFI), although such intelligence may be incidentally collected. Positive 
foreign intelligence can only be intentionally collected pursuant to DIOG Sections 5.6.3.5 
(Type 6 Assessment) and/or Section 9. 

(U//FOUO) See Section 5.11 below for intelligence collection, (i.e., incidental collection') and 
documentation requirements. 


5.6.3.3.1 (U) Duration 

(U//FOUO) A Type 4 Assessment may only be opened with prior supervisor approval. The 
effective date of the Assessment is the date the final approval authority approves the EC as 
specified in Section 5.6.2 above. A Type 4 Assessment may continue for as long as necessary 
to achieve its authorized purpose and clearly defined objective(s). Although a Type 4 
Assessment is not limited in duration, when the clearly defined objective(s) have been met, 
the Assessment must be closed with an EC approved by the supervisor. 

5.6.3.3.2 (U) Documentation 


(U//FOUO) 


(U//FOUO)r 


(TJ//FOUO! This tvne of Assessment must he documented in the annronriatJ 


5.6.3.3.3 (U) Approval 

(U//FOUO) All Type 4 Assessments must be approved in advance by a supervisor and opened 
by an EC. Notwithstanding any other provision in the DIOG, a Type 4 Assessment cannot be 
opened based on oral approval. The supervisor must approve a Type 4 Assessment in 
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accordance with the standards discussed in DIOG Section 5.5. Additional approval 
requirements apply to SIMs, as described below. 

5.6.3.3A (U) Sensitive Investigative Matters (SIM) 

(U//FOUO) If the Assessment involves a sensitive investigative matter (SIM), the CDC must 
review and the SAC must approve the Assessment prior to opening. If a SIM arises after the 
opening of a Type 4 Assessment, Assessment activity may continue, but the matter must be 
documented in an EC reviewed by the CDC and approved by the SAC as soon as practicable, 
but not more than five (5) business days after the SIM arises. The term “sensitive 
investigative matter” is defined in DIOG Section 5.7 and Section 10. 

5.6.3. 3. 5 (U) Notice 

(U//FOUO) There is no requirement to provide notice to FBIHQ or DOJ of opening or closing 
Type 4 Assessments. 

5.63.3.6 (U) File Review 

(U//FOUO) A Type 4 Assessment requires file reviews in accordance with DIOG Section 
3.4.4. 

5. 6.3.3. 7 (U) Responsible Entity 

(U//FOUO) A Type 4 Assessment may only be opened by the DI, a FIG or FBIHQ 
Domain/Strategic intelligence components within the operational divisions. 

5.6.33.8 (U) Examples of Type 4 Assessments 


5.6.3.3.8.1 (U) Example 1 
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5.63.3.8.2 (U) Example 2 



5.6.3.4 (U) Type 5 Assessments 

(U) Type 5 Assessment defined : Seek information to identify potential human sources, 
assess their suitability, credibility, or value of individuals as human sources. 


b7E 


b7E 


b7E 


b7E 


b7E 
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(U//FOUO) A Type 5 Assessment provides the authority and a mechanism to identify, 

evaluate and recruit a Potential Confidential Human Source (CHS) prior to opening and 

operating them as a CHS in | ~|A Type 5 Assessment is not a prerequisite to opening an b7E 

individual as an operational CHS in | t fthe necessary information for opening has 

been obtained through other methods (e.g., following arrest, an individual agrees to become as 

CHS). 

(U//FOUO) A Type 5 Assessment may be opened: 

A) (U//FOUO) on a specific named individual who is a potential CHS; or 

B) (U//FOUO) without a specific named individual, if the goal is to identify individuals with 
placement and access to particular information. 

(U//FOUO) A Type 5 Assessment may not be opened on a subject of a Predicated 
Investigation. A previously opened CHS cannot be opened as a Type 5 Assessment. 

(U//FOUO) Type 5 Assessment activities may not be based solely on race, ethnicity, national 
origin, religion, or activities protected by the First Amendment, or a combination of only such 
factors. 

(U//FOUO) There are three phases of a Type 5 Assessment. The phases are: (1) Identification 
Phase, (2) Evaluation Phase, and (3) Recruitment Phase. A Type 5 Assessment opened on a 
specific named individual may only use the Evaluation and Recruitment phases as described 
below. A Type 5 Assessment opened without a specific named individual is limited to the 
Identification Phase only. Once the Identification Phase has succeeded in identifying specific 
individuals who might have appropriate placement and access, the FBI employee must open a 
new separate Type 5 Assessment on any individual the employee wishes to further evaluate 
and possibly recruit as a CHS. The original Type 5 Assessment without a specific named 
individual may remain open in the Identification Phase, if the authorized purpose and clearly 
defined objective(s) still exist. 

5 . 6 . 3 . 4.1 (U) Phases of Type 5 Assessments 

5.6.3.4. 1 . 1 (U//FOUO) Identification Phase 

(U//FOUO) This phase may be used by an SA assigned to either a HUMINT or 
investigative squad or by an LA assigned to the field office or FBIHQ to identify potential 
CHSs who seem likely to have placement and access to information or intelligence 
related to criminal or national security threats, or investigations, without naming a 
specific individual . The goal of this phase is to identify individuals with CHS potential, 
who may then be evaluated and recruited under the Evaluation and Recruitment Phases of 
a Type 5 Assessment. 

(U//FOUO) This phase is initiated with the approval of a CHS identification plan. The 
plan, which must be based on a thorough review of available intelligence regarding the 
threat, investigation or collection requirement at issue, must specify characteristics of 
individuals likely to have CHS potential, and the investigative methods (e.g., database 
searches, surveillance of specific locations, attendance at specific events) that will be 
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used to identify individuals with those characteristics. Selection of characteristics/search 
criteria must have a logical connection to intelligence or known facts, and may not be 
based merely on conjecture. In addition, selected characteristics may not be based solely 
on race, ethnicity, national origin, religion or activities protected under the First 
Amendment or a combination of only such factors. See DIOG Section 4 for further 
explanation on the permissible use of race, ethnic identity or activities protected under the 
First Amendment. The investigative methods that may be used to identify individuals 
with the specified characteristics needed must also be based on existing intelligence and 
be reasonably likely to yield individuals with the specified characteristics. 

(U//FOUO) If necessary, after a CHS identification plan has been approved, and a group 
of individuals who potentially have placement and access to the relevant information 
have been identified, the SA or IA may, with authorization set forth in Section 
5.6.3.43. 1, use additional characteristics to narrow the group of individuals to those most 
likely to have the desired placement and access. 

(U//FOUO) Once an SA or LA has narrowed the field to one or more known persons who 
appear to have potential as CHSs, in order to gather additional information regarding 
background and authenticity or, in order for an SA to undertake efforts to recruit the 
individual, a Type 5 Assessment must be opened on the specific named individual(s) in 
accordance with subsection 5.63.4.1.2, below. 

5 .63 .4. 1 .2 (U//FOUO) EVALUATION PHASE 


(U//FOUO) This phase may be used by an SA assigned to either a HUMINT or 
investigative squad or by an IA assigned to the field office or FBIHQ to evaluate a known 
individual believed to have placement and access so that the individual, if successfully 
recruited, can provide the FBI with information of value. The goal of this phase of a Type 
5 Assessment is to gather information, through the use of the investigative methods set 
forth in Section 5.63.4.8, below regarding background, authenticity, and suitability of a 
particular Potential CHS (specific named individual) . An IA who develops information 
during this phase that indicates a Pot ential CHS is worthy of recruitment should prepare a 

| for use by an SA on the appropriate HUMINT or 
investigative squad to recruit the individual. If information developed during this phase 
indicates the individual should not be recruited as a CHS, the Type 5 Assessment must be 
closed. 

5.63.4. 1 .3 (U//FOUO) Recruitment Phase 


(U//FOUO) This phase may only be used by an SA assigned to a HUMINT or 
investigative squad. The goal of this phase of a Type 5 Assessment is to recruit the 
potential CHS to become an operational CHS, and therefore , the rec ruitment phase may 


or other 


focus only on a specific named individual . Information from| 
information/intelligence available to the SA may be used during the recruitment phase. If 
the recruitment is successful, the Type 5 Assessment m pst he clos ed (See Section 
5.63.4.9, below) and the individual opened as a CHS 
must also be closed if the recruitment is not successful 


K 


The Type 5 Assessment 
"eitner because the individual 


declines to become a CHS or a determination is made not to continue the recruitment. 


b7E 


b7E 


Version Dated: 
October 15, 2011 


5-22 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 



UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide §5 

S.6.3.4.2 (U) Duration 

(U//FOUO) The effective date of a Type 5 Assessment is the date the highest level of 
authority required approves the opening EC (or | | A Type 5 

Assessment may continue for as long as necessary to achieve its authorized purpose and 
clearly defined objective(s) as set forth in the three phases above or when it is determined that 
the individual named subject cannot or should not be recruited as a CHS. 

5.6.3A.3 (U) Documentation 

5.6.3.43. 1 (U//FOUO) Identification Phase 

. (U//FOUOH 


1 1 

a: 

b: 

('U//FOUO') 1 1 


(U//FOUO; 


(U//FOUO 
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(U//FOUO; 


(U//FOUO) If a Type 5 Assessment has already been opened and an IA or SA wishes to 
utilize additional characteristics/search criteria or investigative methods in the 
Identification Phase that were not documented in the opening EC, the additional 



b7E 


b7E 


(U//FOUO) A Type 5 Assessment o pened to evaluate and/or recru it a specific person as a 

CHS must hp! nnp.nfrH with an EC tnrl [icing thp annrnnriatp 


A) (U//FOUO]_ 

B) (U//FOUOJ 

C) (U//FOUO)[ 


5. 6.3A.4 (U) Approval 

(U//FOUO) A Type 5 Assessment must be a pproved by the appropriate supervisor and opened 
with an EC (or | ""[ Notwithstanding any other provision in the DIOG, 

a Type 5 Assessment cannot be opened on oral approval. For SAs, a Type 5 Assessment must 
be approved by their SSA. For IAs, a Type 5 Assessment must be approved by the SIA and 
the SSA on the HUMINT or investigative squad that will potentially recruit the individual. An 
SSA and/or SIA must use the standards provided in DIOG Section 5.5 when deciding whether 
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to approve a Type 5 Assessment. Additional approval requirements apply to Sensitive 
Potential CHSs, as described below. 


5 .6.3 .4.4. 1 (U) Conflict Resolution 


(U//FOUO) If there is any conflict between theT 


lor any other PG and 


the DIOG, the DIOG controls. OGC, OIC and CPO should be immediately notified of 
any such conflict. 


5.63.4.4.2 (U//FOUO) SENSITIVE POTENTIAL CHSS AND GROUPS 


(U//FOUO) CDC review and SAC approval is required before a Type 5 Assessment may 
be opened on a Sensitive Potential CHS or if, during the Identification Phase, a sensitive 
characteristic is at least one aspect being used to identify individuals with potential 
placement and access to information of interest. If it is determined after opening a Type 5 
Assessment that a Potential CHS is Sensitive or that a sensitive characteristic must be 
added to the Potential CHS Identification Pl an, the Assessment activity ma y continue, but 
the matter must be documented in an EC for i 1 and reviewed 

by the CDC and approved by the SAC as soon as practicable, but not more than 5 



C) (U//FOUO) An individual prominent within a religious organization; 

D) (U//FOUO) An individual prominent within a domestic political organization; 

E) (U//FOUO) A member of the news media; or 
F ^ (U//FOUQI 

(U//FOUO) DIOG Section 10 should be consulted for a definition of these terms. 

(U//FOUO) For additional information regarding Sensitive Potential CHSs, seel” 
Part 2, & DIOG Section 10. 1.4. 

5.6.3A.5 (U) Notice 


(U//FOUO) There is no requirement to provide notice to FBIHQ or DOJ of opening or closing 
Type 5 Assessments. 
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5. 6.3.4. 6 (U) File Review 


(U//FOUO) The frequ ency of a supervisory file review must be in accordance with DIO G 
subsection 3.4.4.3. See l 

~| for Type 5 Assessment Review Standards (ARS) and procedures. 

(U//FOUO) The T ype 5 Assessment file review must be documented in an EC or l l 

I b nd serialized in the Assessment file. Because Type 5 Assessments are 

confidential, a File Review Sheet is not available to be generated from the FBI’s central 
recordkeeping system. 


lutilized to document the evaluation of the 


(U//FOUO) The EC (or 

ARSs for Tvne 5 Assessment^ must be made part of the Assessment file. Therefore, the EC 

must not be used to memorialize other information, such as 


performance measures, investigative steps, possible evaluation or recruitment outcomes, or 
compliance matters. 


5.6.3A.7 (U) Responsible Entity 


(U//FOUO) A Type 5 Assessment without a specific named individual may be opened by SAs 
on HUMINT or investigative squads or IAs assigned a field office or to FBIHQ. A Type 5 
Assessment on specific named individual may be opened by SAs on HUMINT or 
investigative squads, and by IAs assigned to the field office HUMINT investigative squads, or 
to FBIHQ. 


b7E 


b7E 


b7E 


5.6.3A.8 (U) Authorized Investigative Methods in Type 5 Assessments 

(U//FOUO) Only the following investigative methods may be used in a Type 5 Assessment, 
whether in the identification, evaluation, or recruitment phase. All of these investigative 
methods may be used by SAs. IA’s may only use investigative methods (A) through (F). 

A) (U//FOUO) Public information; 

B) (U//FOUO) Records or information - FBI and DOJ; 

C) (U//FOUO) Records or information - Other Federal, state, local, tribal, or foreign government 
agencies; 

D) (U//FOUO) On-line services and resources; 

E) (U//FOUO) Information voluntarily provided by governmental or private entities; 

F) (U//FOUO) Use of AFID or the Covert Approach is only pe rmitted for us e during approved 

activity in a Type 5 Assessment (See the Note below and the | | 

G) (U//FOUO) CHS use and recruitment; 

H) (U//FOUO) Interview or request information from the public or private entities; 

I) (U//FOUO) Physical surveillance (not requiring a court order); 

J) (U//FOUO) Polygraph examinations (seel 
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K) (U//FOUO) Trash Covers (Searches that do not require a warrant or court order) (Note: SSA 
approval and consultation with CDC/OGC is required prior to use of this method. See DIOG 
Section 18.6.12.5). 

(U//FOUO) Note: Consent Searches are authorized in Assessments. 5 

(U//FOUO) Some investigative methods used during Assessments that may require higher 
supervisory approval are set forth in DIOG Section 18.5. 

(U//FOUO) In addition, as specified in division PGs, there may be agreements (e.g., 
Memoranda of Understanding, etc.) that require additional coordination and approval prior to 
conducting certain activities. 

(U//FOUOI 


(U//FOUO) Note: The Covert Approach, which may be authorized in an approved Type 5 
Assessment, pursuant to the procedures detailed in the l i s not undercover activity 

subject to the provisions of DIOG Section 18.6.13. The distinction between the Covert 
Approach and undercover activity lies in the authorized purpose of the Type 5 Assessment, 
which is to seek information to identify, evaluate, and recruit an individual as a CHS, not to 
seek information relevant to federal crimes or national security threats. 

(U//FOUO) Additionally, in the course of a predicated investigation, an agent cannot utilize 
undercover activity (up to five times pursuant to UCO guidelin es), with the specific purpose 
to identify, evaluate or recruit a potential CHS. The agent must| 


m//FOTT(T> 


(U//FOUO)[ 


5. 6.3.4. 9 (U) Closing Type 5 Assessments 

(U//FOUO) A Type 5 Assessment must be closed under the following circumstances: 


5 (U//FOUO) The DOJ has opined that Consent Searches are authorized in Assessments, as well as in 
Predicated Investigations. 
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A) (U//FOUO) In a Type 5 Assessment opened without a specific named individual, it is 
determined that the characteristics/search criteria used to identify individuals with placement 
and access to needed information have not succeeded in identifying such individuals, or the 
FBI no longer has a need for a CHS with the specified placement and access. Additionally, the 
closing EC must document the factual basis for closing the Assessment; 

B) (U//FOUO) The Identification Phase has succeeded in identifying specific named individuals 
who might have appropriate placement and access. If the FBI wishes to further evaluate and 
possibly recruit any such identified individuals, a separate Type 5 Assessment must be opened 
on that person. The original Type 5 Assessment may remain open in the identification phase if 
the authorized purpose and clearly defined objective still exist. Additionally, the closing EC 
must document the factual basis for closing the Assessment; 

C) (U//FOUO) In a Type 5 Assessment opened on a specific named individual, it is determined 
that the Potential CHS is not a suitable candidate for further evaluation and/or recruitment 
efforts. Additionally, the closing EC must document the factual basis for closing the 
Assessment; 

D) (U//FOUO) In a Type 5 Assessment opened on a specific named individual. SA recruitment 

efforts are successful and the potential CHS has been opened as a CHS ir| |Once the b7E 

successfully recruited potential CHS’ | p s ope ned, all docume nts and records in the 

Type 5 Assessment must be maintained in the CHS’ open >r 

(U//FOUO) In a Type 5 Assessment opened on a specific named individual. SA efforts to 
recruit the potential CHS have been unsuccessful or it is determined that further recruitment 
efforts are not likely to be successful. Additionally, the closing EC must document the factual 
basis for closing the Assessment. 

5.6.3.4.9. 1 (U) Closing Approval for Type 5 Assessments 

(U//FOUO) Type 5 Assessments must be closed, via EC, with SSA approval, if it was 

opened by an SA. Type 5 Assessments must be closed with SIA and SSA approval, if it 

was opened by an IA. 

5.6.3.4.10 (U) Examples of Type 5 Assessments 


5.6.3.4.10.1 (U//FOUO) Examples of a Type 5 Assessment opened Without a 

Specific Named Individual 
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(U//FOUOi 


(U//FOUO' 


5.63 A . 10.2 (U//FOUO) Examples of Type 5 Assessments opened on Specific 

Named potential CHSs 


(TJ/FOIJOt 
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(U//FOUQ1 


(U//FOUO)| 


(U//FOUOT 


(U//FOUO) If the Assessment is opened by an SA : The SA may open a Type 5 Assessment 
with his/her SSA approval. If the recruitmen t is successful, the Type 5 Assessment must be 
closed when the CHS is opened in If the recruitment is unsuccessful, the Type 5 

Assessment must be closed. 


(U//FOUO) If the Assessment is opened by an L4. : The LA must obtain the approval of his/her 
SLA and the supervisor of the relevant investigative or HUMINT s quad to ope n a Type 5 


Lfthe 


Assessment. (Note: An IA may not open an individual as a CHS in 
Assessment determines the person has placement and access to information or intelligence 
that would be of value, the Type 5 Assessment must be transferred to the appropriate 
investigative squad or the HUMINT squad to further evaluate and recruit the potential CHS. 


5.6.3.5 (U) Type 6 Assessments 

(U) Type 6 Assessment defined : Seek information, proactively or in response to 
investigative leads, relating to matters of foreign intelligence interest responsive to 
foreign intelligence requirements. 
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(U//FOUO) A Type 6 Assessment is designed to allow the FBI to determine whether the 
circumstances within a field office’s territory would enable the office to conduct a Full 
Investigation to collect information responsive to a Positive Foreign Intelligence (PFI) 
requirement. PFI requirements are described in DIOG Section 9.1. A Type 6 Assessment 
focuses on a field office’s capability to collect on those PFI requirements. While no particular 
factual predication is required, the basis of the Assessment cannot be arbitrary or groundless 
speculation, nor can the Assessment be based solely on the exercise of First Amendment 
protected activities or on race, ethnicity, national origin or religion, or a combination of only 
those factors. 

(U//FOUO) Foreign Intelligence is “information relating to the capabilities, intentions, or 
activities of foreign governments or elements thereof, foreign organizations, or foreign 
persons.” The FBI defines a PFI requirement as a collection requirement issued by the USIC 
and is accepted by the FBI DI that seeks to collect information outside the FBI’s core national 
security mission. 

(U//FOUO) FBI employees must prioritize collection in response to FBI national collection 
requirements before attempting to collect against a positive foreign intelligence collection 
requirement. The IPG furnishes guidance on the prioritization of collection. 

(U//FOUO) See Section 5.1 1 below for intelligence collection, (i.e.. incidental collection! and 
documentation requirements | 


5 . 6 . 3 . 5.1 (U) Duration 


(U//FOUO) There are no time limitations on the duration of a type 6 Assessment. The 
effective date of the Assessment is the date on which the DI - Field Intelligence Management 
Section (FIMS), Field Intelligence Management Unit (FIMU), UC approves the EC. See 
DIOG section 5.6.2 above. A Type 6 Assessment may continue for as long as necessary to 
achieve its authorized purpose and clearly defined objective(s). Although a Type 6 
Assessment is not limited in duration, when the authorized purpose and clearly defined 
objective(s) have been met, the Assessment must be closed or converted to a Full 
Investigation with an EC approved by the field office SSA or SLA and the FIMU UC. When 
closing a Type 6 Assessment that is designated as a SIM, the SAC and the DCHMS SC must 
approve the closing EC. 


5 . 6 . 3 . 5.2 (U) Documentation 


UJ//FOUO') A Tvne 6 A ssessment must be opened by EC, using the appropriate 


JThe opening EC synopsis must identify the authorized purpose and the 


clearly defined objective(s) of the Assessment. The authorized purpose and clearly defined 
objective(s) should be described in more detail in the Details section of the EC. If additional 
objectives arise during the course of the Assessment thpv must alsa he documented in an EC 
and annrnved hv the field office SSA nr ST A 
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(U//FOUO)r 


5. 6.3.5.3 (U) Approval 

(U//FOUO) All Type 6 Assessments must be opened by EC and approved in advance by an 
SSA or SIA and the appropriate DI UC. A Type 6 Assessment must be approved in 
accordance with the standards provided in DIOG Section 5.5. Notwithstanding any other 
provision in the DIOG, a Type 6 Assessment cannot be opened on oral approval. 

5.6.3.5A (U) Sensitive Investigative Matters (SIM) 

(U//FOUO) If a Type 6 Assessment involves a sensitive investigative matter, the CDC/OGC 
must review and the SAC and the appropriate DI SC must approve the Assessment prior to 
opening. If a sensitive investigative matter arises after the opening of a Type 6 Assessment, 
Assessment activity may continue, but the matter must be reviewed by the CDC and approved 
by the SAC and the FIMS SC, as soon as practicable, but not more than five (5) business days 
after the sensitive investigative matter arises. The term “sensitive investigative matter” is 
defined in DIOG Section 5.7 and Section 10. 

5.6.3.S.5 (U) Notice 

(U//FOUO) FBIHQ authority, as specified above, is required to open a Type 6 Assessment; 
the opening EC will serve as notice to the DI. There is no requirement to provide notice to 
DOJ of opening or closing a Type 6 Assessment. 

5.63.5.6 (U) File Review 

(U//FOUO) A Type 6 Assessment requires file reviews in accordance with DIOG Section 
3.4.4. 

5.63.5. 7 (U) Responsible Entity 

(U//FOUO) A Type 6 Assessment may only be opened and conducted by the FIG and the DI 
(Refer to IPG for further details). Under the management of the FIG, field office investigative 
squads or FBIHQ divisions may support the collection of information in a Type 6 
Assessment. 


b7E 


5.63.5.8 (U) Examples/Scenarios of Type 6 Assessments 

5.6.3.5.8.1 (U) Example 1 

(U//FOUO)| 
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5.63.5.8.2 (U) Example 2 



5.7 (U) Sensitive Investigative Matters (SIM) in Assessments and 

Sensitive Potential CHS or Sensitive Characteristic Designations in 
Type 5 Assessments 



contains the required approval authority and factors for consideration when determining whether 
to open or approve an Assessment involving a SIM. 
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5 . 7 . 1 (U) SIM Ca tegories in Assessments 

(U//FOUO) A SIM is an investigative matter involving the activities of a domestic public official 
or domestic political candidate (involving corruption or a threat to the national security), 
religious or domestic political organization or individual prominent in such an organization, or 
news media, an academic nexus, or any other matter which, in the judgment of the official 
authorizing an Assessment, should be brought to the attention of FBIHQ and other DOJ officials. 
(AGG-Dom, Part VII.N.) As a mat ter of FBI policy, “judgment” means that the decision of th e 
authorizing official is discretionarvl I 


(U//FOUOj 


5. 7.2 (U) A cademic Nexus in Assessments 

(U//FOUO) As a matter of FBI policy, an investigative activity having an “academic nexus” is 


considered a SIM if: 


A 

.) (u//fouo; 




B 

) (u//fouoJ 






(U//FOUO) The sensitivity related to an academic institution arises from the American tradition 
of “academic freedom” (e.g., an atmosphere in which students and faculty are free to express 
unorthodox ideas and views and to challenge conventional thought without fear of repercussion). 
Academic freedom does not mean, however, that academic institutions are off limits to FBI 
investigators in pursuit of information or individuals of legitimate investigative interest. 

(U//FOUQ1 


5.8 (U) Standards for Opening or Approving the Use of an Authorized 

Investigative Method 

(U//FOUO) Prior to opening or approving the use of an authorized investigative method, an FBI 
employee or approving official must determine whether: 

A) (U//FOUO) The use of the particular investigative method is likely to further the authorized 
purpose and clearly defined objective(s) of the Assessment; 

B) (U//FOUO) The investigative method selected is the least intrusive method reasonable based 
upon the circumstances of the investigation; 
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C) (U//FOUO) The anticipated value of the Assessment justifies the use of the selected 
investigative method or methods; 

D) (U//FOUO) If the purpose of the Assessment is to collect positive foreign intelligence, the 
investigative method complies with the AGG-Dom requirement that the FBI operate openly 
and consensually with an USPER, to the extent practicable; and 

E) (U//FOUO) The investigative method is an appropriate use of personnel and financial 
resources. 

5 .9 (U) Authorized Investigative Methods in Assessments 

5. 9.1 (U) Type 1 through 4 and Type 6 Assessments 

(U//FOUO) A complete discussion of these investigative methods, including approval 
requirements, is contained in DIOG Section 18. The use or dissemination of information 
obtained by the use of the below-methods must comply with the AGG-Dom and DIOG Section 
14. Only the following investigative methods are authorized in Type 1 through 4 and Type 6 
Assessments: 

A) (U) Public information. (Section 18.5.1) 

B) (U) Records or information - FBI and DOJ. (Section 1 8.5.2) 

C) (U) Records or information - Other federal, state, local, tribal, or foreign government agency. 
(Section 18.5.31 

D) (U) On-line services and resources. (Section 18.5.41 

E) (U) CHS use and recruitment. (Section 18.5.51 

F) (U) Interview or request information from the public or private entities. (Section 18.5.61 

G) (U) Information voluntarily provided by governmental or private entities. (Section 18.5.71 

H) (U) Physical Surveillance (not requiring a court order). (Section 18.5.81 

I) (U) Grand jury subpoenas - for telephone or electronic mail subscriber information only (only 
available in a Type 1 & 2 Assessment). (Section 18.5.91 

(U//FOUO) Note : Consent Searches are authorized in Assessments. 


5. 9.2 (U) Type 5 Assessments 

(U//FOUO) In addition to those investigative methods listed above in 5.9.1(A) - (H), Type 5 
Assessments only may also use the following investigative methods: 


A) (U) Use of AFID or Cov ert Approac h only permitted for use during approved activity in a 


Type 5 Assessment. (Sea 


B) (U) Polygraph Examinations (See 

C) (U) Trash Covers (Searches that do not require a warrant or court order). (See Section 18.6.121 
(Note: SSA approval and consultation with CDC/OGC required prior to use of this method). 


b7E 


5-35 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 


Version Dated: 
October 15, 2011 



UNCLASSIFIED - FOR OFFICIAL USE ONLY 
§5 Domestic Investigations and Operations Guide 

5.10 (U) Other Investigative Methods Not Authorized During Assessments 


(U//FOUO) Additional investigative methods, which are authorized for Predicated 
Investigations, may not be used in Assessments. 

5.11 (U) Intelligence Collection (i.e., Incidental Collection) 

b7E 


b7E 


5.12 (U) Retention and Dissemination of Privacy Act Records 


(U//FOUO)f 



(U//FOUO) The Privacy Act restricts the maintenance of records relating to the exercise of First 
Amendment rights by individuals who are USPERs. Such records may be maintained if the 
information is pertinent to and within the scope of authorized law enforcement activities or for 
which there is otherwise statutory authority for the purposes of the Privacy Act (5 U.S.C. § 
522a[e][7]). Activities authorized by the AGG-Dom are authorized law enforcement activities. 
Thus, information concerning the exercise of First Amendment rights by USPERs may be 
retained if it is pertinent to or relevant to the FBFs law enforcement or national security activity. 
Relevancy must be determined by the circumstances. If the information is not relevant to the law 
enforcement activity being conducted, then it may not be retained. For more information see 
DIOG Section 4.1. (AGG-Dom, Part I.C.5) 

(U) The Privacy Act, however, may not exempt from disclosure information gathered by the FBI 
during Positive Foreign Intelligence Assessments (Type 6 Assessments) and investigations of 
qualified U.S. citizens or lawfully admitted permanent residents if personally identifying 
information about such persons resides in those files. FBI employees should therefore be 
particularly vigilant about properly classifying any such information and should avoid 
unnecessary references to, and the documentation of, identifying information about U.S. citizens 
and lawfully admitted permanent residents in Positive Foreign Intelligence files. See DIOG 
Section 4.1.3. 

(U//FOUO) Even if information obtained during an Assessment does not warrant opening a 
Predicated Investigation, the FBI may retain personally identifying information for criminal and 
national security purposes. In this context, the information may eventually serve a variety of 
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valid analytic purposes as pieces of the overall criminal or intelligence picture are developed to 
detect and disrupt criminal and terrorist activities. In addition, such information may assist FBI 
personnel in responding to questions that may subsequently arise as to the nature and extent of 
the Assessment and its results, whether positive or negative. Furthermore, retention of such 
information about an individual collected in the course of an Assessment will alert other 
divisions or field offices considering conducting an Assessment on the same individual that the 
particular individual is not a criminal or national security threat. As such, retaining personally 
identifying information collected in the course of an Assessment will also serve to conserve 
resources and prevent the initiation of unnecessary Assessments and other investigative 
activities. 

5.12.1 (U) Marking Type 1&2, and Type 3, 4 and 6 Closed Assessments That 

Contain Personal Information 

(U) Information obtained during an Assessment that has insufficient value to justify further 
investigative activity may contain personal information. As a result: (i) when records retained in 
an Assessment specifically identify an individual or group whose possible involvement in 
criminal or national security-threatening activity was checked out through the Assessment; and 
(ii) the Assessment turns up no sufficient basis to justify further investigation of the individual or 
group, then the records must be clearly annotated as follows: 

(U) “It is noted that the individual or group identified during the Assessment does 
not warrant further FBI investigation at this time. Any dissemination of information 
from this Assessment regarding the individual or group identified must include an 
appropriate caveat with the shared information. It is recommended that this 
Assessment be closed.” 

(U) Extreme care should be taken when disseminating personally identifiable information 
collected during an Assessment that does not lead to sufficient facts to open a Predicated 
Investigation. If personal information from the Assessment is disseminated outside the FBI 
according to authorized dissemination guidelines and procedures, it must be accompanied by the 
required annotation that the Assessment involving this individual or group did not warrant 
further investigation by the FBI at the time the Assessment was closed. 

5.12.1.1 (U) Type 1& 2 Assessments 

(yy/Fouoj ~ 

the FD-71 or Guardiai] f 

|theFD-71 o r Guardian, 

[ Moreover, any FBI employee who shares information outside the FBI 
from such a closed Assessment file must ensure the following caveat is included in the 
dissemination: 

(U) “This person [or group] was identified during an Assessment but no information 
was developed at that time that warranted further investigation of the person [or 
group].” 
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5.12.1.2 (U) Type 3, 4, and 6 Assessments 

(U//FOUOI | 

| Moreover, any FBI employee who shares 

information outside the FBI from such a closed Assessment file must ensure the following caveat 
is included in the dissemination: 

(U) “This person [or group] was identified during an Assessment but no information 
was developed at that time that warranted further investigation of the person [or 
group].” 


b7E 


5.12.1.3 (U) Type 5 Assessments 

(U//FOUO) 



(U//FOUO) Any dissemination from a closed Type 5 Assessment must be conducted in 
accordance with dissemination guidance on CHS closed files provided in thel 

5.13 (U) Assessment File Records Management and Retention 


(U//FOUO) 




the FD-71 or Guardian 1 




JRecords must be retained according to National Archives 


and Records Administration (NARA) approved disposition authorities. 


(U//FOUO)| 


Guardian 




Guardian (FD-71 a) 


Guardiar 


records in Guardian, or any 


successor information technology system, must be retained according to NARA-approved 
disposition authorities. Consult the RMD Help Desk for assistance. 


b7E 


b7E 


b7E 


b7E 


b7E 
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(U//FOUO) Type 3, 4, 5, and 6 Assessments must havef 



d 

must be approved by the SSA or SIA 

<1 A .1 .11 1 * Y-1^-, 

If additional objectives arise 


during the Assessm ent, they must be documen ted in an EC, approved by the SSA or if 
appropriate, an SIA J [ Assessment classification files must be retained 

according to NARA-approved disposition authorities. 


5 . 13.1 (U) Pending Inactive Status 

(U//FOUO J 

5.14 (U) Other Program Specific Investigation Requirements 

(U//FOUO) To facilitate compliance within an existing investigative program, the FBI employee 
should consult the relevant division’s PG. FBIHQ division PGs, however, may not contradict, 
alter or otherwise modify the standards established in the DIOG. 


b7E 


b7E 
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6 (U) PRELIMINARY INVESTIGATIONS 


§6 


6.1 (U) Overview 

(U) The AGG-Dom authorizes a second level of investigative activity — Predicated 
Investigations. Predicated Investigations that concern federal crimes or threats to the national 
security are subdivided into Preliminary Investigations (PI) and Full Investigations (Full). A 
Preliminary Investigation may be opened on the basis of any “allegation or information” 
indicative of possible criminal activity or threats to the national security. 

6.2 (U) Purpose and Scope 

(U//FOUO) A Preliminary Investigation may be opened to detect, obtain information about, or 
prevent or protect against federal crimes or threats to the national security. However, a 
Preliminary Investigation cannot be opened or used solely for the purpose of collecting against 
Positive Foreign Intelligence (PFI) requirements, or for conducting an Enterprise Investigation 
(El). 

(U) The purposes for conducting Preliminary Investigation include such matters as: determining 
whether a federal crime has occurred or is occurring, or if planning or preparation for such a 
crime is taking place; identifying, locating, and apprehending the perpetrators; obtaining 
evidence needed for prosecution; or identifying threats to the national security. 

(U) The investigation of threats to the national security may constitute an exercise of the FBI’s 
criminal investigation authority as well as its authority to investigate threats to the national 
security. As with criminal investigations, detecting and solving crimes and arresting and 
prosecuting the perpetrators are likely objectives of investigations relating to threats to the 
national security. These investigations, however, serve important purposes outside the ambit of 
normal criminal investigations, by providing the basis for decisions concerning other measures 
needed to protect the national security. 

6.3 (U) Civil Liberties and Privacy 

(U) The pursuit of legitimate investigative goals without infringing upon the exercise of 
constitutional freedoms is a challenge that the FBI meets through the application of sound 
judgment and discretion. In order to protect civil liberties in the conduct of criminal and national 
security investigations, every Preliminary Investigation under this subsection must have adequate 
predication that is documented in the opening communication. 

(U) No investigative activity, including Preliminary Investigations, may be taken solely on the 
basis of activities that are protected by the First Amendment or on the race, ethnicity, national 
origin or religion of the subject, or a combination of only those factors. Preliminary 
Investigations of individuals, groups or organizations must focus on activities related to the 
threats and or crimes being investigated, not solely on First Amendment activities or on the race, 
ethnicity, national origin or religion of the subject. In this context, it is particularly important 
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clearly to identify and document the law enforcement or national security basis of the 
Preliminary Investigation. 

(U) Example : Individuals or groups who communicate with each other or with members of the 
public in any form in pursuit of social or political causes — such as opposing war or foreign 
policy, protesting government actions, promoting certain religious beliefs, championing 
particular local, national, or international causes, or a change in government through non- 
criminal means, and actively recruit others to join their causes — have a fundamental 
constitutional right to do so. A Preliminary Investigation may not be opened based solely on the 
exercise of these First Amendment rights. 

(U) The AGG-Dom present investigators with a number of authorized investigative methods in 
the conduct of a Preliminary Investigation. Considering the effect on the privacy and civil 
liberties of individuals and the potential to damage the reputation of individuals, some of these 
investigative methods are more intrusive than others. The least intrusive method if reasonable 
based upon the circumstances of the investigation is to be used, but the FBI must not hesitate to 
use any lawful method consistent with the AGG-Dom. A more intrusive method may be 
warranted in light of the seriousness of a criminal or national security threat. 

(U) By emphasizing the use of the least intrusive means to obtain intelligence, information, 
and/or evidence, FBI employees can effectively execute their duties while mitigating the 
potential negative impact on the privacy and civil liberties of all people encompassed within the 
investigation, including targets, witnesses, and victims. This principle is not intended to 
discourage FBI employees from seeking relevant and. necessary intelligence, information, or 
evidence, but rather is intended to encourage FBI employees to choose the least intrusive — but 
still reasonable based upon the circumstances of the investigation — means from the available 
options to obtain the intelligence, information or evidence. (See DIOG Section 4.4). 

6.4 (U) Legal Authority 

6.4.1 (U) Criminal Investigations 

(U) The FBI has statutory authority to investigate all federal crime not assigned exclusively to 
another federal agency. (See 28 U.S.C. § 533; 18 U.S.C. § 3052; 28 C.F.R. § 0.85 [a]) 

(U) The FBI also has special investigative jurisdiction to investigate violations of state law in 
limited circumstances. Specifically, the FBI has jurisdiction to investigate felony killings of state 
law enforcement officers (28 U.S.C. § 540), violent crimes against interstate travelers (28 U.S.C. 
§ 540A), and serial killers (28 U.S.C. § 540B). Authority to investigate these matters is 
contingent on receiving a request by an appropriate state official. 

6.4.2 (U) Threats to the National Security 

(U) The FBI has authority to investigate threats to the national security pursuant to executive 
orders, Attorney General authorities, and various statutory sources. (See Appendix B: 
Executive Order (EO) 12333; 50 U.S.C. §§ 401 et seq.; 50 U.S.C. §§ 1801 et seq.) 
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(U) “Threats to the national security” are specifically defined to mean: international terrorism; 
espionage and other intelligence activities, sabotage, and assassination, conducted by, for, or 
on behalf of foreign powers, organizations, or persons; foreign computer intrusion; and other 
matters determined by the Attorney General, consistent with EO 12333 or any successor 
order. (AGG-Dom, Part VII.S) 

6.5 (U) Predication 

(U) A Preliminary Investigation may be opened on the basis of “information or an.allegation” 
indicating the existence of a circumstance described as follows: 

A) (U) An activity constituting a federal crime or a threat to the national security has or may have 
occurred, is or may be occurring, or will or may occur and the investigation may obtain 
information or intelligence relating to the activity or the involvement or role of an individual, 
group, or organization in such activity. (AGG-Dom, Part II.B.3) 

B) (U) An individual, group, organization, entity, information, property, or activity is or may be a 
target of attack, victimization, acquisition, infiltration, or recruitment in connection with 
criminal activity in violation of federal law or a threat to the national security and the 
investigation may obtain information or intelligence that would help to protect against such 
activity or threat. (AGG-Dom, Part II.B.3) 

(U//FOUO) Examples : The following examples have sufficient predication to open a Preliminary 
Investigation: 

A) (U//FOUO) A CHS, with no established history, alleges that an individual is a member of a 
terrorist group; this “allegation” is sufficient predication to open a Preliminary Investigation; 
and 

B) (U//FOUO) If an analyst, while conducting an assessment, discovers on a blog a threat to a 
specific person, this “information” is enough to open a Preliminary Investigation. 

NOTE: (U) See classified provisions of appendix G for additional circumstances warranting a 
Preliminary Investigation. 

6.6 (U) Standards for Opening or Approving a Preliminary Investigation 

(U) Before opening or approving the conduct of a Preliminary Investigation, an FBI employee or 
approving official must determine whether: 

A) (U//FOUO) Adequate predication exist for opening a Preliminary Investigation; 

B) (U//FOUO) The Preliminary Investigation is not based solely on the exercise of First 
Amendment activities or on the race, ethnicity, national origin or religion of the subject or a 
combination of only such factors; and 

C) (U//FOUO) The Preliminary Investigation is an appropriate use of personnel and financial 
resources. 

(U//FOUO) Additional policies regarding Preliminary Investigations involving any foreign 
ambassador, foreign official, foreign student or exchange visitor, protected persons or premises 
as subjects may be found in to DIOG Appendix G - Classified Provisions [No Foreign Policy 
Objection]. 
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(U//FOUO) A Preliminary Investigation cannot be opened based solely on an FBI collection 
requirement. 

6.7 (U) Opening Documentation, Approval, Effective Date, Notice, 

Extension, Pending Inactive Status, Conversion, and File Review 

6. 7.1 (U) Opening Documentation 

(U//FOUO) The predication to open a Preliminary Investigation must be documented in the 
opening Electronic Communication (EC). In addition to the opening EC, division PGs may 
require the use of other specific forms to supplement the opening EC, i.e. FD-920, etc. The 
appropriate approving authority may grant oral authority to open a Preliminary Investigation if 
the standards for opening or approving a Preliminary Investigation are met. Should oral 
authorization to conduct a Preliminary Investigation be granted, an EC setting forth the 
predicating facts, as well as the identity of the authorizing supervisor and date of oral 
authorization, must be documented to the supervisor who granted the oral authorization, as soon 
as practicable, but not more than five (5) business days after granting oral authorization. 

(U//FOUO)| 


(U//FOUO) The DIOG prohibits the use of control files or administrative files to document 
investigative activity. (See DIOG Appendix J) 


6.7.1.1 (U) Approval / Effective Date / Notice 

(U//FOUO) The effective date of the Preliminary Investigation is the date the final approval 
authority (e.g., Supervisory Special Agent (SSA) or Special Agent-in-Charge (SAC)) 
approves the EC| ~ 

[If the Preliminary Investigation is 

opened on oral authority, the date on which the oral authority was granted is the effective 
date. See DIOG Section 3.4.2.2. Adding another subject after opening the Preliminary 
Investigation does not change the original effective date or the extension date. 


A) (U//FOUO) Opened By a Field Office : The opening of a Preliminary Investigation hv the 
field office requires prior approval of the SSA. 


B) (U//FOUO) Opened. By FBIHO : The opening of a Preliminary Investigation hv FRTHO 
requires prior approval of the Unit Chief (UC~) 
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C) (U//FOUO) Sensitive Investigate Matters (SIM) : The opening of a Preliminaiy 
Investigation involving a SIM: 

1) (U//FOUO) SIM Opened bv a Field Office: requires prior Chief Division Counsel (CDC) 
review and SAC approval, and written notification (EC and a disseminable Letterhead 
Memorandum (LHM)), to the appropriate FBIHQ operational UC and Section Chief (SC) 
within 15 calendar days following the opening. Additionally, the field office must notify 
the United States Attorney’s Office (USAO), in writing, unless such notification is 
inappropriate under the circumstances (e.g., a public corruption investigation of a person 
who is personally close to the United States Attorney (USA)) or the matter is a 
counterintelligence or espionage investigation. (See CD PG for details concerning notice in 
counterintelligence and espionage investigations.) If notice is not provided to the USAO 
under the exceptions described above, the field office must explain those circumstances in 
the written notice to FBIHQ. The responsible FBIHQ section must notify, in writing, the 
appropriate DOJ Criminal Division or NSD official as soon as practicable, but no later than 
30 calendar days after the investigation is opened. The notice must identify all known 
SIMs involved in the investigation (see DIOG Appendix G - Classified Provisions for 
additional notice requirements). If a SIM arises after the opening of a Preliminary 
Investigation, investigative activity may continue, but the matter must be reviewed by the 
CDC and approved by the SAC as soon as practicable, but not more than five (5) business 
days thereafter to continue the investigation. Notice must be provided as specified above. 

2) (U//FOUO) SIM Opened Ay FBIHQ : requires prior OGC review and SC approval, and 
written notification (an EC and disseminable LHM) to any appropriate field office within 
15 calendar days following the opening; the USAO, unless such notification is 
inappropriate under the circumstances, (e.g., a public corruption investigation of a person 
who is personally close to the USA) or the matter is a counterintelligence or espionage 
investigation; and the appropriate DOJ Criminal Division or NSD official, as soon as 
practicable, but no later than 30 calendar days after the investigation is opened. (See CD 
PG for details concerning notice in counterintelligence and espionage investigations.) If 
notice is not provided to the USAO under the circumstances described above, FBIHQ must 
explain those circumstances in the written notice to the field office(s) and DOJ. The notice 
must identify all known SIMs involved in the investigation (see DIOG Appendix G - 
Classified Provisions for additional notice requirements). If a SIM arises after the opening 
of a Preliminary Investigation, investigative activity may continue, but the matter must be 
reviewed by OGC and approved by the appropriate FBIHQ operational SC as soon as 
practicable, but not more than five (5) business days thereafter to continue the 
investigation. Notice must be provided as specified above. 

D) (U//FOUO) FBIHQ Disapproves Opening : The Executive Assistant Director (EAD) for the 
National Security Branch must notify the Deputy Attorney General if FBIHQ disapproves a 
field office’s opening of a Preliminary Investigation relating to a threat to the national security 
on the ground that the predication for the investigation is insufficient, and the EAD for the 
National Security Branch is responsible for establishing a system that will allow for the 
prompt retrieval of such denials. (AGG-Dom, Part II.B.5.d) 
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6 . 7.2 (U) Extension 

(U//FOUO) A Preliminary Investigation must be concluded within six months of its opening but 
may be extended for up to six months by the SAC (delegable to the ASAC) 6 . FBIHQ division 
PGs may require written notification of this six month extension to the appropriate FBIHQ 
operational unit and section. Extensions of Preliminary Investigations beyond a year are 
discouraged and may only be approved by the appropriate FBIHQ operational section for “good 
cause.” (AGG-Dom, Part II.B.4.a.ii) 

6.7.2.1 (U) Good Cause 

(U//FOUO) The following factors must be used to determine whether “good cause” exists to 
extend the Preliminary Investigation beyond one year: 

A) (U//FOUO) Whether logical investigative steps have yielded information that tends to 
inculpate or exculpate the subject; 

B) (U//FOUO) The progress that has been made toward determining whether a Full Investigation 
should be opened or the Preliminary Investigation should be closed; 

C) (U//FOUO) Whether, based on the planned course of investigation for the following six 
months, it is reasonably likely that information will be obtained that will lead to predication 
for a Full Investigation, thereby warranting an extension for another six months, or will lead to 
exculpatory information, thereby warranting closing the Preliminary Investigation; and 

D) (U//FOUO) Whether adequate predication has been developed to justify opening a Full 
Investigation or whether sufficient information has been developed that justifies closing the 
Preliminary Investigation. 

6 . 7.3 (U) Pending Inactive Status 

m//FOTT(T)l I 


b7E 


6 . 7.4 (U) Conversion to Full Investiga tion 

(U//FOUO) When converting a Preliminary Investigation to a Full Investigation, see DIOG 
Section 7 for approval and notification requirements. 

6 . 7.5 (U) File Review 

(U//FOUO) Supervisory file reviews must be conducted at least once every 90 days in 
accordance with DIOG Section 3.4.4. File reviews for probationary FBI employees must be 
conducted at least every 60 days. 


6 (U//FOUO) SAC approval required to extend Preliminary Investigations was non-delegable in the previous 
version of the DIOG. That restriction has been removed in this version. 


Version Dated: 
October 15. 2011 


6-6 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 



UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide §6 

6.8 (U) Standards for Opening or Approving the Use of an Authorized 
Investigative Method in Preliminary Investigations 

(U//FOUO) Prior to opening or approving the use of an investigative method, an FBI employee 
or approving official must determine whether: 

A) (U//FOUO) The use of the particular investigative method is likely to further the authorized 

purpose of the Preliminary Investigation; — 

B) (U//FOUO) The investigative method selected is the least intrusive method, if reasonable 
based upon the circumstances of the investigation; and 

C) (U//FOUO) The method to be used is an appropriate use of personnel and financial resources. 

6.9 (U) Authorized Investigative Methods in Preliminary Investigations 

(U) All lawful methods may be used in a Preliminary Investigation, except for mail opening, 
physical search requiring a Federal Rules of Criminal Procedure (FCRP) Rule 41 search warrant 
or a Foreign Intelligence Surveillance Act (FISA) order, electronic surveillance requiring a 
judicial order or warrant (Title III or FISA), or Title VII FISA requests. Authorized methods 
include, but are not limited to, those listed below. Some of the methods listed are subject to 
special restrictions or review or approval requirements. (AGG-Dom, Part V.4.A) 

(U//FOUO) A complete discussion of these investigative methods, including approval 
requirements, is contained in Section 18. The use or dissemination of information obtained by 
the use of the below methods must comply with the AGG-Dom and DIOG Section 14. The 
following investigative methods are authorized to be used in Preliminary Investigations: 

A) (U) Public information. (See Section 18.5.n 

B) (U) Records or information - FBI and DOJ. (See Section 1 8.5.2) 

C) (U) Records or information - Other federal, state, local, tribal, or foreign government agency. 
(See Section 18.5.3) 

D) (U) On-line services and resources. (See Section 18.5.4) 

E) (U) CHS use and recruitment. (See Section 18.5.5) 

F) (U) Interview or request information from the public or private entities. (See Section 18.5.6) 

G) (U) Information voluntarily provided by governmental or private entities. (See Section 18.5.7) 

H) (U) Physical Surveillance (not requiring a court order). (See Section 18.5.8) 

I) (U) Consensual monitoring of communications, including electronic communications. (See 
Section 18.6.1) 

(U//FOUO) Note : For those state, local and tribal governments that do not sanction or provide 
a law enforcement exception available to the FBI for one-party consent recording of 
communications with persons within their jurisdiction, the SAC must approve the consensual 
monitoring of communications as an Otherwise Illegal Activity (OIA). Prior to the SAC 
authorizing the OIA, one-party consent must be acquired. The SAC may delegate the OIA 
approval authority to an Assistant Special Agent-in-Charge (ASAC) or Supervisory Special 
Agent (SSA). 


6-7 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 


Version Dated: 
October 15, 2011 


UNCLASSIFIED - FOR OFFICIAL USE ONLY 
§6 Domestic Investigations and Operations Guide 

(U//FOUO) See the classified provisions in Appendix G for additional information. 

J) Intercepting the communications of a computer trespasser. (See Section 18.6.2 ) 

K) (U) Closed-circuit television/video surveillance, direction finders, and other monitoring 
devices. (See Section 1 8.6.31 

L) (U) Administrative subpoenas. (See Section 18.6.41 

M) (U) Grand jury subpoenas. (See Section 18.6.51 

N) (U) National Security Letters. (See Section 18.6.61 

O) (U) FISA Order for business records. (See Section 18.6.71 

P) (U) Stored wire and electronic communications and transactional records. (See Section 
18.6.81 7 

Q) (U) Pen registers and trap/trace devices. (See Section 18.6.91 

R) (U) Mail covers. (See Section 18.6.101 

S) (U) Polygraph examinations. (See Section 18.6.111 

T) (U) Trash Covers (Searches that do not require a warrant or court order). (See Section 18.6.121 

U) (U) Undercover operations. (See Section 18.6.131 

(U) See the classified provisions in DIOG Appendix G for additional information. 

6.10 (U) Sensitive Investigative Matters (SIM) in Preliminary 

Investigations 

(U//FOUO)| 

fc )IOG Section 10 

contains the required approval authority and factors for consideration when determining whether 
to conduct or approve a Preliminary Investigation involving a SIM. 

6.10.1 (U) SIM Categories in Preliminary Investigations 

(U//FOUO) A SIM is an investigative matter involving the activities of a domestic public official 
or domestic political candidate (involving corruption or a threat to the national security), 
religious or domestic political organization or individual prominent in such an organization, or 
news media, an academic nexus, or any other matter which, in the judgment of the official 
authorizing an investigation, should be brought to the attention of FBIHQ and other DOJ 

officials. (AGG-Dom, Part VII.N.) As a matter of FBI policy, “judgment” means that the 

decision of the authorizing official is discretionarvl 


b7E 


b7E 


7 (U//FOUO) The use of Search Warrants to obtain this information in Preliminary Investigations is 
prohibited. (See DIOG Section 18.6.8.4.2.3) 
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6.10.2 

(U) Academic Nexus in Preliminary Investigations 

(U//FOUC 

y 


A) (U//FOUO) [ 



B) 

(U//FOUO)| 1 



(U//FOUO) The sensitivity related to an academic institution arises from the American tradition 
of “academic freedom” (e.g., an atmosphere in which students and faculty are free to express 
unorthodox ideas and views and to challenge conventional thought without fear of repercussion). 
Academic freedom does not mean, however, that academic institutions are off limits to FBI 
investigators in pursuit of information or individuals of legitimate investigative interest. 

(U//FOUQ1 

6.11 (U) Intelligence Collection (i.e., Incidental Collection) 

(u//FQUoj 


|(See DIOG Section 15.6.1.2 - Written Intelligen ce Products) 

(U//FOUO)| 


6.12 (U) Standards for Approving the Closing of a Preliminary 

Investigation 

6.12.1 (U) Standards 

(U//FOUO) At the conclusion of a Preliminary Investigation, each of the following items must 
be documented in the closing communication (EC and/or LHM): 

A) (U//FOUO) A summary of the results of the investigation; 


b7E 
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B) (U//FOUO) Whether all logical and reasonable investigation was completed; 

C) (U//FOUO) Whether all investigative methods/techniques initiated have been completed 
and/or discontinued; 

D) (U//FOUO) Whether all leads set have been completed and/or discontinued; 

E) (U//FOUO) Whether all evidence has been returned, destroyed or retained in accordance with 
evidence policy;, and 

F) (U//FOUO) A summary statement of the basis on which the Preliminary Investigation will be 
closed, and a selection of the appropriate closing status: 

1) (U//FOUO) C-4: Administrative Closing, which includes: 

a) (U//FOUO) No further investigation is warranted because logical investigation and/or 
leads have been exhausted, and the investigation to date did not identify a criminal 
violation or a priority threat to the national security 

b) (U//FOUO) Investigation assigned a new file number 

c) (U//FOUO) Investigation consolidated into a new file number or an existing file 
number, or 

d) (U//FOUO) Unaddressed Work investigation file closed because no investigation or no 
further investigation will be conducted 

2) (U//FOUO) C-5: USA Declination Closing, which includes: 

a) (U//FOUO) The USAO declined prosecution - individual matter declination 

b) (U//FOUO) The USAO declined prosecution - blanket declination 

3) (U//FOUO) C-6: Other Closing, which includes: 

a) (U//FOUO) National security investigation has been completed 

b) (U//FOUO) Prosecution became non-viable for national security reasons 

c) (U//FOUO) Any other reason to close 

6.12.2 (U) Approval Requirements to Close 

(U//FOUO) The appropriate closing supervisor described below must review and approve the 
closing communication (as described in Section 6.12.1) to ensure it contains the above required 
information and sufficient details of the investigation on which to base the decision to close the 
Preliminary Investigation. The appropriate closing supervisors are: 

A) (U//FOUO) Opened by a Field Office: Closing a Preliminary Investigation opened by a field 
office requires approval from the SSA. Notification to the FBIHQ operational unit may be 
required by division PGs. 

B) (U//FOUO) Opened by FBIHQ: Closing a Preliminary Investigation opened by FBIHQ 
requires approval from the UC and notification to any appropriate field office. 

C) (U//FOUO) SIM Opened by a Field Office: Closing a Preliminary Investigation opened by a 
field office involving a SIM requires approval from the SAC, written notification to the 
FBIHQ operational unit and section and the USAO, if the USAO was notified of the opening. 
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D) (U//FOUO) SIM Opened by FBIHQ: Closing a Preliminary Investigation opened by FBIHQ 
involving a SIM requires approval from the SC and written notification to any appropriate 
field office. 

6.13 (U) Other Program Specific Investigative Requirements 

(U//FOUO) To facilitate compliance with investigative program specific requirements, the FBI 
employee should consult the relevant division’s PG . No policy or PG may contradict, alter or 
otherwise modify the standards of the DIOG. Requests for DIOG modifications can be made to 
the Corporate Policy office (CPO) pursuant to DIOG Section 3.2.2 paragraphs (A), (B), (C) and 

(D). 
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7 (U) FULL INVESTIGATIONS 


7.1 (U) Overview 

(U//FOUO) The AGG-Dom authorizes a second level of investigative activity — Predicated 
Investigations. Predicated Investigations that concern federal crimes or threats to the national 
security are subdivided into Preliminary Investigations (PI) and Full Investigations (Full). A Full 
Investigation may be opened if there is an “articulable factual basis” of possible criminal or 
national threat activity, as discussed in greater detail in Section 7.5, below. There are three types 
of Full Investigations: (i) single and multi-subject; (ii) Enterprise; and (iii) positive foreign 
intelligence collection. 

7.2 (U) Purpose and Scope 

(U) A Full Investigation may be opened to detect, obtain information about, or prevent or protect 
against federal crimes or threats to the national security or to collect foreign intelligence. 

(U) The purposes for conducting Full Investigations include such matters as: 

A) (U) determining whether a federal crime is being planned, prepared for, occurring or has 
occurred; 

B) (U) identifying, locating, and apprehending the perpetrators; 

C) (U) obtaining evidence for prosecution; 

D) (U) identifying threats to the national security; 

E) (U) investigating an enterprise (as defined in DIOG Section 8); or 

F) (U) collecting positive foreign intelligence (PFI) (as defined in DIOG Section 9). 

(U) The investigation of threats to the national security can be investigated under the FBI’s 
criminal investigation authority or its authority to investigate threats to the national security. As 
with criminal investigations, detecting and solving crimes, gathering evidence and arresting and 
prosecuting the perpetrators are frequently the objectives of investigations relating to threats to 
the national security. These investigations also serve important purposes outside the ambit of 
normal criminal investigations, however, by providing the basis for decisions concerning other 
measures needed to protect the national security. 

(U//FOUO) A Full Investigation solely for the collection of positive foreign intelligence extends 
the sphere of the FBI’s information gathering activities beyond federal crimes and threats to the 
national security and permits the FBI to seek information regarding a broader range of matters 
relating to foreign powers, organizations, or persons that may be of interest to the conduct of the 
United States’ foreign affairs. (See DIOG Section 9) 

7.3 (U) Civil Liberties and Privacy 

(U) The pursuit of legitimate investigative goals without infringing upon the exercise of 
constitutional freedoms is a challenge that the FBI meets through the application of sound 
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judgment and discretion. In order to protect civil liberties during the conduct of criminal and 
national security investigations, every Full Investigation under this subsection must have 
adequate predication that is documented in the opening communication. 

(U) No investigative activity, including Full Investigations, may be taken solely on the basis of 
activities that are protected by the First Amendment or on the race, ethnicity, national origin or 
religion of the subject, or a combination of only those factors. Full Investigations of individuals, 
groups or organizations must focus on activities related to the threats or crimes being 
investigated, not solely on First Amendment activities or on the race, ethnicity, national origin or 
religion of the subject. In this context, it is particularly important clearly to identify and 
document the law enforcement or national security basis of the Full Investigation. 

(U) Example : Individuals or groups who communicate with each other or with members of the 
public in any form in pursuit of social or political causes — such as opposing war or foreign 
policy, protesting government actions, promoting certain religious beliefs, championing 
particular local, national, or international causes, or a change in government through non- 
criminal means, and actively recruit others to join their causes — have a fundamental 
constitutional right to do so. A Full Investigation may not be opened based solely on the exercise 
of these First Amendment rights. 

(U) The AGG-Dom authorize all lawful investigative methods in the conduct of a Full 
Investigation. Considering the effect on the privacy and civil liberties of individuals and the 
potential to damage the reputation of individuals, some of these investigative methods are more 
intrusive than others. The least intrusive method if reasonable based upon the circumstances of 
the investigation is to be used, but the FBI must not hesitate to use any lawful method consistent 
with the AGG-Dom. A more intrusive method may be warranted in light of the seriousness of a 
criminal or national security threat or the importance of a foreign intelligence requirement. 

(U) By emphasizing the use of the least intrusive means to obtain intelligence or evidence, FBI 
employees can effectively execute their duties while mitigating the potential negative impact on 
the privacy and civil liberties of all people encompassed within the investigation, including 
targets, witnesses, and victims. This principle is not intended to discourage FBI employees from 
seeking relevant and necessary intelligence, information, or evidence, but rather is intended to 
encourage FBI employees to choose the least intrusive — but still reasonable based upon the 
circumstances of the investigation — from the available options to obtain the intelligence, 
information or evidence. (See DIOG Section 4) 

7.4 (U) Legal Authority 

7.4.1 (U) Criminal Investigations 

(U) The FBI has statutory authority to investigate all federal crime not assigned exclusively to 
another federal agency. (See 28 U.S.C. § 533; 18 U.S.C. § 3052; 28 C.F.R. § 0.85 [a].) 

(U) The FBI also has special investigative jurisdiction to investigate violations of state law in 
limited circumstances. Specifically, the FBI has jurisdiction to investigate felony killings of state 
law enforcement officers (28 U.S.C. § 540), violent crimes against interstate travelers (28 U.S.C. 
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§ 540A), and serial killers (28 U.S.C. § 540B). Authority to investigate these matters is 
contingent on receiving a request by an appropriate state official. 

7.4.2 (U) Threats to the National Security 

(U) The FBI has authority to investigate threats to the national security pursuant to executive 
orders, Attorney General authorities, and various statutory sources. (See E.0. 12333; 50 U.S.C. 
§§ 401 et seq.; 50 U.S.C. §§ 1801 et seq.) 

(U) “Threats to the national security” are specifically defined to mean: international terrorism; 
espionage and other intelligence activities, sabotage, and assassination, conducted by, for, or on 
behalf of foreign powers, organizations, or persons; foreign computer intrusion; and other 
matters determined by the Attorney General, consistent with Executive Order 12333 or any 
successor order. (AGG-Dom, Part VII.S) 

7.4.3 (U) Foreign Intelligence Collection 

(U) The FBI authority to collect foreign intelligence derives from a mixture of administrative and 
statutory sources. (See E.O. 12333; 50 U.S.C. §§ 401 et seq.; 50 U.S.C. §§ 1801 et seq.; 28 
U.S.C. § 532 note (incorporates the Intelligence Reform and Terrorism Protection Act, P.L. 1 OS- 
458 §§ 2001-2003). 

(U) “Foreign Intelligence” is defined as information relating to the capabilities, intentions, or 
activities of foreign governments or elements thereof, foreign organizations or foreign persons, 
or international terrorists. (AGG-Dom, Part VII.E) 

7.5 (U) Predication 

(U) A Full Investigation may be opened if there is an “articulable factual basis” that reasonably 
indicates one of the following circumstances exists: 

A) (U) An activity constituting a federal crime or a threat to the national security has or may have 
occurred, is or may be occurring, or will or may occur and the investigation may obtain 
information relating to the activity or the involvement or role of an individual, group, or 
organization in such activity; 

B) (U) An individual, group, organization, entity, information, property, or activity is or may be a 
target of attack, victimization, acquisition, infiltration, or recruitment in connection with 
criminal activity in violation of federal law or a threat to the national security and the 
investigation may obtain information that would help to protect against such activity or threat; 
or 

C) (U) The investigation may obtain foreign intelligence that is responsive to a PFI requirement, 
as defined in DIOG Section 7.4.3, above. 

(U//FOUO) Examples : The following examples have sufficient predication to open a Full 
Investigation: 

A) (U//FOUO) corroborated information from an intelligence agency states that an individual is a 
member of a terrorist group; 
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B) (U//FOUO) an analyst discovers on a blog a threat to a specific home builder and additional 
information connecting the blogger to a known terrorist group; and 

C) (U//FOUO) FBI DI has posted an authorized PFI requirement for collection. 

NOTE: (U) See classified provisions of appendix G for additional circumstances warranting a Full 
Investigation. 

7.6 (U) Standards for Opening or Approving a Full Investigation 

(U//FOUO) Before opening or approving the conduct of a Full Investigation, an FBI employee or 
approving official must determine whether: 

A) (U//FOUO) Adequate predication exist for opening a Full Investigation; 

B) (U//FOUO) The Full Investigation is not based solely on the exercise of First Amendment 
activities or on the race, ethnicity, national origin or religion of the subject or a combination of 
only such factors; and 

C) (U//FOUO) The Full Investigation is an appropriate use of personnel and financial resources. 

(U//FOUO) Additional policies regarding Full Investigations involving any foreign ambassador, 
foreign official, foreign student or exchange visitor, protected persons or premises as subjects 
may be found in DIOG Appendix G - Classified Provisions [No Foreign Policy Objection 
(NFPO)]. 

(U//FOUO) A Full Investigation cannot be opened solely based on an FBI collection 
requirement. 

7.7 (U) Opening Documentation, Approval, Effective Date, Notice, 

Pending Inactive Status, File Review, and Letter Head Memorandum 

7. 7.1 (U) Opening Documentation 

(U//FOUO) The predication to open a Full Investigation must be documented in the opening EC. 
In addition to the opening EC, division PGs may require the use of other specific forms to 
supplement the opening EC, i.e. FD-920, etc. The appropriate approving authority may grant oral 
authority to open a Full Investigation if the standards for opening or approving a Full 
Investigation are met. Should oral authorization to conduct a Full Investigation be granted, an EC 
setting forth the predicating facts, as well as the identity of the authorizing supervisor and date of 
oral authorization, must be documented to the supervisor who granted the oral authorization, as 
soon as practicable, but not more than five (5) business days after granting the authorization. 

(U//FOUO)| 


b7E 


(U//FOUO) The DIOG prohibits the use of control files or administrative files to document 
investigative activity. See DIOG Appendix J. 
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7.7.1.1 (U) Approval / Effective Date / Notice 

(U//FOUO) The effective date of th e Full Investigation is the date the final approval authorit y 
(e.g„ SSA or SAC) approves the ECl I 

j f the Full 

Investigation is opened on oral authority, the date on which the oral authority was granted is 
the date the investigation was opened. See Section 3. 4.2.2. 

A) (U//FOUO) Opened By a Field Office : The opening of a Full Investigation for circumstances 
described in Sections 7.5.A and 7.5.B (i.e., for any reason other than to collect intelligence 
that is responsive to a PFI requirement) by a field office requires prior approval of the SSA 
with written notification within 15 calendar days of the opening to the responsible FBIHQ 
operational unit. The opening of a Full Investigation of a United States person (USPER) 
relating to a threat to the national security for circumstances described in Sections 7.5.A and 
7.5.B (i.e., for any reason other than to collect intelligence that is responsive to a PFI 
requirement) requires the responsible FBIHQ-NSB unit to notify DOJ NSD as soon as 
practicable, but in all events within 30 calendar days after the investigation is opened or the 
subject is determined to be an USPER. If the subject of the investigation is a non-USPER and 
later becomes or is determined to be an USPER, the notice provisions in this subsection to 
DOJ NSD also apply. 

B) (U//FOUO) Opened By FBIHQ : The opening of a Full Investigation by FBIHQ for 
circumstances described in Sections 7.5.A and 7.5.B (i.e., for any reason other than to collect 
intelligence that is responsive to a PFI requirement) requires prior approval of the UC with 
written notification within 15 calendar days of the opening to any appropriate field office. The 
opening of a Full Investigation by FBIHQ of an USPER relating to a threat to the national 
security for circumstances described in Sections 7.5.A and 7.5.B (i.e., for any reason other 
than to collect intelligence that is responsive to a PFI requirement) also requires notice to DOJ 
NSD as soon as practicable, but in all events within 30 days after the investigation is opened 
or the subject is determined to be an USPER. If the subject of the investigation is a non- 
USPER and later becomes or is determined to be an USPER, the notice provisions in this 
subsection to the field office and DOJ also apply. 

C) (U//FOUO) Sensitive Investigative Matters (SIM} : The opening of a Full Investigation 
involving a sensitive investigative matter: 

1) (U//FOUO) SIM. Opened By a Field. Office : requires prior CDC review and SAC 

approval, and written notification (EC and disseminable LHM) to the appropriate FBIHQ 
operational UC and SC within 15 calendar days following the opening. Additionally, the 
field office must notify the USAO, in writing, unless such notification is inappropriate 
under the circumstances (e.g., a public corruption investigation of a person who is 
personally close to the United States Attorney (USA)), or the matter is a 
counterintelligence or espionage investigation. (See CD PG for details concerning notice in 
counterintelligence and espionage investigations.) If notice is not provided to the USAO 
under the circumstances described above, the field office must explain those circumstances 
in the written notice to FBIHQ. The responsible FBIHQ section must notify, in writing, the 
appropriate DOJ Criminal Division official or NSD official as soon as practicable, hut no 
later than 30 calendar davs after the investigation is onened I 
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jNotice must be furnished as specified above. 


2) (U//FOUO) SIM Opened By FBIHQ : requires prior OGC review and SC approval, and 
written notification (EC and disseminable LHM) to any appropriate field office within 15 
calendar days following the opening. Additionally, FBIHQ operational unit must notify the 
appropriate USAO(s) in writing, unless such notification is inappropriate under the 
circumstances (e.g., a public corruption investigation of a person who is personally close to 
the USA) or the matter is a counterintelligence or espionage investigation; and the 
appropriate DOJ Criminal Division official or NSD official, as soon as practicable, but no 
later than 30 calendar days after such an investigation is opened. (See CD PG for details 
concerning notice in counterintelligence and espionage investigations.) If notice is not 
provided to the USAO under the “circumstances” exception described above, F EBIHQjnust 
explain the circumstances in the written notice to the field office(s) and DOJ. 


b7E 


| Notice must be furnished as specified above. 

(AGG-Dom, Part II.B.5.a) 

D) (U//FOUO) Positive Foreign Intelligence Full Investigation : The opening of a Full 
Investigation in order to collect positive foreign intelligence for circumstances described in 
Section 7.5.C above must be approved as provided in DIOG Section 9. Additionally, written 
notification to FBIHQ Domain, Collection, HUMINT Management Section (FIMS) SC and 
DOJ NSD is required as soon as practicable but no later than 30 calendar days after opening 
the investigation. 

E) (U//FOUO) FBIHQ Disapproves Opening : The EAD for the National Security Branch (NSB) 
must notify the Deputy Attorney General if FBIHQ disapproves a field office’s opening of a 
Full Investigation relating to a threat to the national security on the ground that the predication 
for the investigation is insufficient, and the EAD for the NSB is responsible for establishing a 
system that will allow for the prompt retrieval of such denials. (AGG-Dom, Part II.B.5.d) 

7. 7.2 (U) Pending Inactive Status 

(U//FOUO) A Full Investigation may be placed in “pending inactive” status once all logical 
investigation has been completed and only prosecutive action or other disposition remains to be 
reported. Examples of Full Investigations that may be placed in “pending inactive” status would 
include, but not be limited to: criminal investigations pending an appeal; fugitive investigations, 
when all logical investigation has been conducted and the subject is still in fugitive status; 
parental kidnapping investigations, when the parent who kidnapped the child is residing in a 
foreign country and the local authorities will not or cannot extradite the subject back to the 
United States. 

7 . 7.3 (U) File Review 

(U//FOUO) Supervisory file reviews must be conducted at least once every 90 days in 
accordance with DIOG Section 3.4.4. File reviews for probationary FBI employees must be 
conducted at least every 60 days. 
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7. 7.4 (U) Annual Letterhead Memorandum 

(U//FOUO) Annual letterhead memoranda regarding the status of Full Investigations are not 
required by the AGG-Dom; however, the FBIHQ operational divisions may require such reports 
in their PGs. See foreign intelligence collection in Section 9 for annual reporting requirements to 
FBIHQ FIMS and DOJ. 

7.8 (U) Standards for Opening or Approving the Use of an Authorized 
Investigative Method in Full Investigations 

(U//FOUO) Prior to opening or approving the use of an investigative method, an FBI employee 
or approving official must determine whether: 

A) (U//FOUO) The use of the particular investigative method is likely to further the authorized 
purpose of the Full Investigation; 

B) (U//FOUO) The investigative method selected is the least intrusive method, if reasonable 
based upon the circumstances of the investigation; 

C) (U//FOUO) If the Full Investigation is for collecting positive foreign intelligence, the FBI is 
operating openly and consensually with a USPER, to the extent practicable; and 

D) (U//FOUO) The method to be used is an appropriate use of personnel and financial resources. 

7.9 (U) Authorized Investigative Methods in Full Investigations 

(U) All lawful methods may be used in a Full Investigation, unless the investigation is to collect 
foreign intelligence. A complete discussion of these investigative methods, including approval 
requirements, is contained in Section 18 . The use or dissemination of information obtained by the 
use of these methods must comply with the AGG-Dom and DIOG Section 14. The following 
investigative methods are authorized to be used in all Full Investigations, other than 
investigations to collect foreign intelligence: 

A) (U) Public information. (Section 18.5.P 

B) (U) Records or information - FBI and DOJ. (Section 18.5.2J 

C) (U) Records or information - Other federal, state, local, tribal, or foreign government agency. 

(Section 18.5.3J 

D) (U) On-line services and resources. (Section 18.5.4~) 

E) (U) CHS use and recruitment. (Section 18.5.51 

F) (U) Interview or request information from the public or private entities. (Section 18.5.6J 

G) (U) Information voluntarily provided by governmental or private entities. (Section 18.5.7J 

H) (U) Physical Surveillance (not requiring a court order). (Section 18.5.81 

I) (U) Consensual monitoring of communications, including electronic communications. 

(Section 18.6.U 

fUZ/FOUCfi Note A I b7E 
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(U//FOUO) See the classified provisions in Appendix G for additional information. 

J) (U) Intercepting the communications of a computer trespasser. (Section 18.6.2) 

K) (U) Closed-circuit television/video surveillance, direction finders, and other monitoring 
devices. (Section 18.6.3) 

L) (U) Administrative subpoenas. (Section 18.6.4) 

M) (U) Grand jury subpoenas. (Section ISAS') 

N) (U) National Security Letters. (Section 18.6.61 

O) (U) FISA Order for business records. (Section 18.6.7) . 

P) (U) Stored wire and electronic communications and transactional records. (Section 18.6.81 

Q) (U) Pen registers and trap/trace devices. (Section 18.6.91 

R) (U) Mail covers. (Section 18.6.10) 

S) (U) Polygraph examinations. (Section 18.6.11) 

T) (U) Trash Covers (Searches that do not require a warrant or court order). (Section 18.6.12) 

U) (U) Undercover Operations (Section 18.6.13) 

V) (U) Searches - with a warrant or court order. (Section 18.7.1) 

W) (U) Electronic surveillance - Title III. (Section 18.7.2) 

X) (U) Electronic surveillance - FISA and FISA Title VII (acquisition of foreign intelligence 
information). (Section 18.7.3) 

(U) See the classified provisions in DIOG Appendix G for additional information. 

7.10 (U) Sensitive Investigative Matters (SIM) in Full Investigations 

(u//fouo| 

| DIOG 

Section 10 contains the required approval authority and factors to be considered when 
determining whether to conduct or approve a Full Investigation involving a SIM. 

7.10.1 (U) SIM Ca tegories in Full Investiga tions 

(U//FOUO) A SIM is an investigative matter involving the activities of a domestic public official 
or domestic political candidate (involving corruption or a threat to the national security), 
religious or domestic political organization or individual prominent in such an organization, or 
news media, an academic nexus, or any other matter which, in the judgment of the official 
authorizing an investigation, should be brought to the attention of FBIHQ and other DOJ 
officials. (AGG-Dom, Part VII.N). As a matter of FBI policy, “judgment” means that the 
decision of the authorizing offici al is discretionary. DIOG Section 10 and/or the DTOG Annendix 
G - Classified Provisions define 1 
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7.10.2 (U) Academic Nexus in Full Investigations 

(U//FOUO)! 


A) (U//FOUO)[ 


B ) (U//FOUOH I 


(U//FOUO) The sensitivity related to an academic institution arises from the American tradition 
of “academic freedom” (i.e., an atmosphere in which students and faculty are free to express 
unorthodox ideas and views and to challenge conventional thought without fear of repercussion). 
Academic freedom does not mean, however, that academic institutions are off limits to FBI 
investigators in pursuit of information or individuals of legitimate investigative interest. 

(U//FOUO) I 


7.1 1 (U) Intelligence Collection (i.e. Incidental Collection) 

(U//FOUO)! 


b7E 
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(See DIOG Section 15.6.1.2 - Written Intelligence Products' 


(U//FOUO)f 


(U) Because the authority to collect positive foreign intelligence enables the FBI to obtain 
information pertinent to the United States’ conduct of its foreign affairs, even if that information 
is not related to criminal activity or threats to the national security, the information gathered may 
concern lawful activities. Accordingly, the FBI must operate openly and consensually with an 
USPER to the extent practicable when collecting positive foreign intelligence that does not 
concern criminal activities or threats to the national security. 
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7.12 (U) Standards for Approving the Closing of a Full Investigation 

7.12.1 (U) Standards 

(U//FOUO) At the conclusion of a Full Investigation, each of the following items must be 
documented in the closing communication (EC and/or LHM): 

A) (U//FOUO) A summary of the results of the investigation; 

B) (U//FOUO) Whether sufficient personnel and financial resources were expended on the 
investigation, or an explanation/justification for not expending sufficient resources; 

C) (U//FOUO) Whether logical and reasonable investigation was completed; 

D) (U//FOUO) Whether all investigative methods/techniques initiated have been completed 
and/or discontinued; 

E) (U//FOUO) Whether all leads set have been completed and/or discontinued; 

F) (U//FOUO) Whether all evidence has been returned, destroyed or retained in accordance with 
evidence policy; and 

G) (U//FOUO) A summary statement of the reason the Full Investigation will be closed, and 
selection of the appropriate closing status: 

1) (U//FOUO) C-4: Administrative Closing, which includes: 

a) (U//FOUO) No further investigation is warranted because logical investigation and/or 
leads have been exhausted, and the investigation to date did not identify a criminal 
violation or a priority threat to the national security 

b) (U//FOUO) Investigation assigned a new file number 

c) (U//FOUO) Investigation consolidated into a new file number or an existing file number 

d) (U//FOUO) Unaddressed Work investigation file closed because no investigation or no 
further investigation will be conducted 

2) (U//FOUO) C-5: USA Declination Closing, which includes: 

a) (U//FOUO) The USAO declined prosecution - individual matter declination 

b) (U//FOUO) The USAO declined prosecution - blanket declination 

3) (U//FOUO) C-6: Other Closing, which includes: 

a) (U//FOUO) Final prosecution or final prosecutive action has been completed 

b) (U//FOUO) National security investigation has been completed 

c) (U//FOUO) Prosecution became non-viable for national security reasons 

d) (U//FOUO) A federal grand jury returned a “No True Bill” 

e) (U//FOUO) A nolle prosequi has been entered with the court 

f) (U//FOUO) any other reason for closing 
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7.12.2 (U) Approval Requirements to Close 

(U//FOUO) The appropriate closing supervisor described below must review and approve the 
closing communication (as described in Section 7.12.1) to ensure it contains the above-required 
information and sufficient details of the investigation on which to base the decision to close the 
Full Investigation. Although there is no duration limit for a Full Investigation, the investigation 
must be closed upon all investigative activity being exhausted. The appropriate closing 
supervisors are: 

A) (U//FOUO) Opened by a Field Office : Closing a Full Investigation opened by a field office 
requires approval from the SSA. Notification to the FBIHQ operational unit may be required 
by division PGs. 

B) (U//FOUO) Opened by FBIHQ : Closing a Full Investigation opened by FBIHQ requires 
approval from the UC and notification to the appropriate field office. 

C) (U//FOUO) SIM Opened bv a Field Office : Closing a Full Investigation opened by a field 
office involving a sensitive investigative matter requires approval from the SAC and written 
notification to the FBIHQ operational unit and section and the USAO, if the USAO was 
notified of the opening. 

D) (U//FOUO) SIM Opened bv FBIHQ : Closing a Full Investigation opened by FBIHQ 
involving a sensitive investigative matter requires approval from the SC and written 
notification to the appropriate field office. 

E) (U//FOUO) Positive Foreign Intelligence : (See DIOG Section 9) 

7.13 (U) Other Program Specific Investigative Requirements 

(U//FOUO) To facilitate compliance with investigative program-specific requirements, the FBI 
employee should consult the relevant division’s PG to ascertain any program-specific 
requirements. No policy or PG may contradict, alter or otherwise modify the standards of the 
DIOG. Requests for DIOG modifications can be made to the Corporate Policy office (CPO) 
pursuant to DIOG Section 3.2.2 paragraphs (A), (B), (C) and (D). 
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8 U) ENTERPRISE INVESTIGATIONS (El) 


8.1 (U) Overview 

(U) An Enterprise Investigation (El) may only be opened and operated as a Full Investigation 
and is subject to the same requirements that apply to a Full Investigation as described in DIOG 
Section 7, although there are additional approval requirements that affect Enterprise 
Investigations. An Enterprise Investigation focuses on a group or organization that may be 
involved in the most serious criminal or national security threats to the public, as described in 
Section 8.5 below. An Enterprise Investigation cannot be conducted as Preliminary Investigation 
or an Assessment, nor may they be conducted for the sole purpose of collecting positive foreign 
intelligence (PFI). See Section 8.2, below, regarding Preliminary Investigations and 
Assessments. 

8.2 (U) Purpose, Scope and Definitions 

(U) Enterprise defined : An enterprise is a group of persons associated together for a common 
purpose of engaging in a course of conduct. The term “enterprise” includes any partnership, 
corporation, association, or other legal entity, and any union or group of individuals associated in 
fact, although not a legal entity. 

(U) Associated in fact defined : The term "associated in fact" means the persons have an 
ongoing organization, formal or informal, and that the persons function together as a continuing 
unit. 

(TT) Purpose/Scope : The purpose of an Enterprise Investigation is to examine the structure, 
scope, and nature of the group or organization including: its relationship, if any, to a foreign 
power; the identity and relationship of its members, employees, or other persons who may be 
acting in furtherance of its objectives; its finances and resources; its geographical dimensions; its 
past and future activities and goals; and its capacity for harm. (Attorney General’s Guidelines for 
Domestic FBI Operations (AGG-Dom), Part II.C.2) 

(U) Note : Enterprise Investigations were designed, among other things, to combine and replace 
the traditional “Racketeering Enterprise Investigations” (92 classification) and “Terrorism 
Enterprise Investigations” (100 classification). An Enterprise Investigation is only authorized to 
be opened on the most serious criminal or national security threats. The term Enterprise 
Investigation as used in the DIOG should not be confused with other usages of the word 
“enterprise,” such as criminal enterprise investigations (e.g., 281 classification, 245 
classification, etc.), which are not Enterprise Investigations as defined in DIOG Section 8. See 
DIOG Sections 8.4 and 8.5. 

(U//FOUO) Although an Enterprise Investigation may not be conducted as a Preliminary 
Investigation, a Preliminary Investigation may be used to determine whether a group or 
organization is a criminal or terrorist enterprise if the FBI has “information or an allegation” that 
an activity constituting a federal crime or a threat to the national security has or may have 
occurred, is or may be occurring, or will or may occur, and the investigation may obtain 
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information relating to the activity of the group or organization in such activity. An Assessment 
may also be opened to determine whether a group or organization is involved in activities 
constituting violations of federal criminal law or threats to the national security. 

8.3 (U) Civil Liberties and Privacy 

(U) The pursuit of legitimate investigative goals without infringing upon the exercise of 
constitutional freedoms is a challenge that the FBI meets through the application of sound 
judgment and discretion. In order to protect civil liberties in the conduct of criminal and national 
security investigations, every Full Investigation, including an Enterprise Investigation under this 
subsection, must have adequate predication documented in the opening communication. 

(U) No investigative activity, including an Enterprise Investigation, may be taken solely on the 
basis of activities that are protected by the First Amendment or on the race, ethnicity, national 
origin or religion of the subject or a combination of only those factors. An Enterprise 
Investigation of groups and organizations must focus on activities related to the threats or crimes 
being investigated, not solely on First Amendment activities or on the race, ethnicity, national 
origin or religion of the members of the group or organization. In this context, it is particularly 
important clearly to identify and document the law enforcement or national security basis of the 
Enterprise Investigation. 

(U//FOUO) Example : Groups who communicate with each other or with members of the public 
in any form in pursuit of social or political causes — such as opposing war or foreign policy, 
protesting government actions, promoting certain religious beliefs, championing particular local, 
national, or international causes, or a change in government through non-criminal means, and 
actively recruit others to join their causes — have a fundamental constitutional right to do so. An 
Enterprise Investigation may not be opened based solely on the exercise of these First 
Amendment rights. 

(U) The AGG-Dom authorizes all lawful investigative methods in the conduct of an Enterprise 
Investigation. Considering the effect on the privacy and civil liberties of individuals and the 
potential to damage the reputation of individuals, some of these investigative methods are more 
intrusive than others. The least intrusive method if reasonable based upon the circumstances of 
the investigation is to be used, but the FBI must not hesitate to use any lawful method consistent 
with the AGG-Dom. A more intrusive method may be warranted in light of the seriousness of a 
criminal or national security threat. 

(U) By emphasizing the use of the least intrusive means to obtain information, intelligence 
and/or evidence, FBI employees can effectively execute their duties while mitigating the 
potential negative impact on the privacy and civil liberties of all people encompassed within the 
investigation, including targets, witnesses, and victims. This principle is not intended to 
discourage FBI employees from seeking relevant and necessary intelligence, information, or 
evidence, but rather is intended to encourage FBI employees to choose the least intrusive — but 
still effective means — from the available options to obtain the information , intelligence or 
evidence. See DIOG Section 4.4. 
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8.4 (U) Predication 

(U) A Full Investigation of a group or organization may be opened as an Enterprise Investigation 
if there is an articulable factual basis for the investigation that reasonably indicates the group or 
organization may have engaged, or may be engaged in, or may have or may be engaged in 
planning or preparation or provision of support for: (AGG-Dom, Part II.C.l) 

A) (U) Racketeering Activity : 

(U) A pattern of racketeering activity as defined in 18 U.S.C. § 1961(5) - (92 and 305A 
matters may be opened as Enterprise Investigations-Racketeering Activity (EI/RA)); 

B) (U) International Terrorism : 

(U) International terrorism, as defined in 18 U.S.C. § 2331 and AGG-Dom, Part VII. J or other 
national security threat - (415 matters may be opened as Enterprise Investigations); 

C) (U) Domestic Terrorism : 

1) (U) Domestic terrorism as defined in 18 U.S.C. § 233 1(5) involving a violation of federal 
criminal law - (100 matters may be opened as Enterprise Investigations); 

2) (U) Furthering political or social goals wholly or in part through activities that involve 
force or violence and a violation of federal criminal law - (100 matters may be opened as 
Enterprise Investigations); or 

3) (U) An offense described in 18 U.S.C. § 2332b(g)(5)(B) or 18 U.S.C. § 43 - (100 matters 
may be opened as Enterprise Investigations). 

(U) The “articulable factual basis” for opening an Enterprise Investigation is met with the 
identification of a group whose statements made in furtherance of its objectives or its conduct 
demonstrate a purpose of committing crimes or securing the commission of crimes by others. 

The group’s activities and statements of its members may be considered in combination to 
comprise the “articulable factual basis,” even if the statements alone or activities alone would not 
warrant such a determination. 

(U//FOUQ1I 



b7E 


b7E 


b7E 

b7E 


8-3 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 


Version Dated: 
October 15, 2011 




UNCLASSIFIED - FOR OFFICIAL USE ONLY 
§8 Domestic Investigations and Operations Guide 

8.5 (U) Standards for Opening or Approving an Enterprise Investigation 

(U//FOUO) Before opening or approving the conduct of an Enterprise Investigation, an FBI 
employee or approving official must determine whether: 

A) (U//FOUO) Adequate predication exists for opening an Enterprise Investigation; 

B) (U//FOUO) The Enterprise Investigation is not based solely on the exercise of First 
Amendment activities or on the race, ethnicity, national origin or religion of the subject or a 
combination of only such factors; and 

C) (U//FOUO) The Enterprise Investigation is an appropriate use of personnel and financial 
resources. 

(U//FOUO) In addition to the above, the FBIHQ SC reviewing the El opening request, must also 
consider whether the request involves an organization or group involved in the most serious 
violations of federal crime or threats to national security, whether the field office requesting to 
open the El is the logical Office of Origin (00) to oversee the investigation, what impact, if any, 
opening the El may have on other field offices, and whether the FBIHQ Section is best 
positioned to support the OO’s investigative strategy and provide deconfliction guidance among 
affected field offices or operational programs, as appropriate. 

(U//FOUO) Additional policies regarding Enterprise Investigation involving any foreign 
ambassador, foreign official, foreign student or exchange visitor, protected persons or premises 
as subjects may be found in DIOG Appendix G - Classified Provisions [No Foreign Policy 
Objection (NFPO)]. 

(U//FOUO) A Predicated Investigation, including an Enterprise Investigation, cannot be opened 
solely based on an FBI collection requirement. 

8.6 (U) Opening Documentation, Effective Date, Approval, Notice, and 
File Review 

8 . 6.1 (U) Opening Documentation 

(U//FOUO) The predication to open an Enterprise Investigation must be documented in the 
opening electronic communication (EC). 

('U/TFOUQjl 


(U//FOUO) The appropriate approving authority (Section Chief) may grant oral authority to open 
an Enterprise Investigation if the standards for opening or approving an Enterprise Investigation 
are met. Should oral authorization to conduct an Enterprise Investigation be granted, an EC 
setting forth the predicating facts, as well as the identity of the approving official(s) (i.e., SC), 
and the date of oral authorization must be documented to the approving official(s) who granted 
the oral authorization as soon as practicable, but not more than five (5) business days after 
granting oral authorization. 
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(U//FOUO) The DIOG prohibits the use of control files or administrative files to document 
investigative activity. (See DIOG Appendix J) 


8. 6.2 (U) Effective Da te 

(U//FOUO) The effective date of the Enterprise Investigation is the date the final approval 
authority (i.e.. SO approves thl 

ff the Enterprise 

Investigation is opened on oral authority, the date on which the oral approval authority was 
granted is the effective date. See DIOG Section 3. 4.2.2. 


8.6.3 (U) Approval Requirements for Opening an Enterprise Investigation 


8.6.3.1 (U) El Opened by a Field Office with Section Chief Approval 

(U//FOUO) The opening of an Enterprise Investigation by an FBI field office requires the 
prior approval of the appropriate FBIHQ SC, as well as written notification to the United 
States Attorney’s Office (USAO) and the Department of Justice (DOJ) as specified below. 

8.6.3.2 (U) El Opened by FBIHQ with Section Chief Approval 

(U//FOUO) The opening of an Enterprise Investigation by an FBIHQ division requires the 
prior approval of the appropriate FBIHQ SC, as well as written notification to the appropriate 
field office(s), USAO and DOJ as specified below 

8.6.3.3 (U) SIM El Opened by a Field Office with Special Agent in Charge and 
Section Chief Approval 

(U//FOUO) A SIM Enterprise Investigation opened by a field office requires prior CDC 
review, SAC and appropriate FBIHQ SC approval, and written notification to DOJ in the 
form of an LHM or similar documentation. The LHM or similar documentation for 
dissemination to DOJ must be submitted to the appropriate FBIHQ operational section within 
15 calendar days following the opening. Additionally, the field office must notify the USAO, 
in writing, unless such notification is inappropriate under the circumstances (e.g., a public 
corruption Enterprise Investigation of a group that is personally close to the United States 
Attorney (USA)), or the matter is a counterintelligence or espionage investigation. (See CD 
PG for details concerning notice in counterintelligence and espionage investigations.) If 
notice is not provided to the USAO under the circumstances described above, the field office 
must explain those circumstances in the written notice to FBIHQ. The responsible FBIHQ 
operational section must notify, in writing, the appropriate DOJ Criminal Division or National 
Security Division (NSD) official as soon as practicable, but no later than 30 calendar days 
after the investigation is opened.l I 


(U//FOUO) 


b7E 


b7E 


b7E 


8-5 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 


Version Dated: 
October 15. 2011 




§ 8 . 


UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 


[Notice must be furnished as specified above. 

8.6.3.4 (U) SIM El Opened by FBIHQ with Section Chief Approval 

(U//FOUO) A SIM Enterprise Investigation opened by FBIHQ requires prior OGC review 
and SC approval, and written notification to DOJ and appropriate field office(s) in the form of 
an LHM or similar documentation. The LHM or similar documentation for dissemination to 
the field office(s) must be submitted within 15 calendar days following the opening. 
Additionally, the FBIHQ operational unit must notify the appropriate USAO(s) in writing, 
unless such notification is inappropriate under the circumstances (e.g., a public corruption 
Enterprise Investigation of a group that is personally close to the USA), or the matter is a 
counterintelligence or espionage investigation. (See CD PG for details concerning notice in 
counterintelligence and espionage investigations.) If notice is not provided to the USAO 
under the circumstances described above, the FBIHQ operational unit must explain those 
circumstances in the written notice to the field office(s) and DOJ. The responsible FBIHQ 
operational section must notify, in writing, the appropriate DOJ Criminal Division or National 
Security Division (NSD) officia l as soon as practicable, but no later than 30 calendar da.vs 
after the investigation is ooenedl 


(U//FOUO)| 

| Notice must be furnished as specified above. 

8.6.4 (U) Notice Requirements 

(U//FOUO) FBIHQ division PGs may require specific facts to be included in a field office 
request to open an Enterprise Investigation. At a minimum, the request must include whether the 
Enterprise Investigation is a SIM. 

(U//FOUO) The responsible FBIHQ section must notify the DOJ NSD or the Organized Crime 
and Racketeering Section (OCRS) of the opening of an Enterprise Investigation by a field office 
or by FBIHQ, as soon as practicable but no later than 30 calendar days after the opening of the 
investigation. 

(U//FOUO) For Enterprise Investigations that involve groups of persons who pose a national 
security threat, the responsible DOJ component for the purpose of notification and reports is the 
NSD. For Enterprise Investigations relating to a pattern of racketeering activity that does not 
involve a national security threat, the responsible DOJ component is the OCRS of the Criminal 
Division. (AGG-Dom, Part II.C.3) 

(U) The Assistant Attorney General for National Security or the Chief of the OCRS, as 
appropriate, may at any time request the FBI to provide a report on the status of an Enterprise 
Investigation, and the FBI will provide such reports as requested. (AGG-Dom, Part II C.3.d) 


b7E 


b7E 


b7E 
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8. 6.5 (U) File Review 

(U//FOUO) Supervisory file reviews must be conducted at least once every 90 days in 
accordance with DIOG Section 3.4.4. File reviews for probationary agents must be conducted at 
least once every 60 days. 


8. 6. 6 (U) Pending Inactive St a tus 

(U/zfouoI 


b7E 


8.7 (U) Authorized Investigative Methods in an Enterprise Investigation 

(U//FOUO) An Enterprise Investigation may only be opened and operated as a Full Investigation 
and is subject to the same requirements that apply to a Full Investigation. Therefore, the 
standards for opening or approving the use of investigative methods and the availability of 
investigative methods that may be used in an Enterprise Investigation are the same as set forth in 
Sections 7.8 and 7.9. 

8.8 (U) Sensitive Investigative Matters (SIM) in Enterprise 
Investigations 


(U//FOUOT 


P 


] DIOG Section 1 0 contains the required approval authority and factors to be considered 


when determining whether to conduct or approve a Full Enterprise Investigation involving a 
SIM. 


8.8.1 (U) SIM Categories in Enterprise Investigations 

(U//FOUO) A SIM is an investigative matter involving the activities of a domestic public official 
or domestic political candidate (involving corruption or a threat to the national security), 
religious or domestic political organization or individual prominent in such an organization, or 
news media, an academic nexus, or any other matter which, in the judgment of the official 
authorizing an investigation, should be brought to the attention of FBIHQ and other DOJ 
officials. (AGG-Dom, Part VII.N). As a matter of FBI policy, “judgment” meahs that the 
decision of the authorizing offic ial is discretionary. DIOG Section 10 and/or the DIOG Appendix 
G - Classified Provisions define) I 


b7E 


b7E 


8.8.2 (U) Academic nexus in Enterprise Investigations 

(U//FOUO)! 


A) (U//FOUO) 


b7E 
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(U//FOUO) The sensitivity related to an academic institution arises from the American tradition 
of “academic freedom” (e.g., an atmosphere in which students and faculty are free to express 
unorthodox ideas and views and to challenge conventional thought without fear of repercussion). 
Academic freedom does not mean, however, that academic institutions are off limits to FBI 
investigators in pursuit of information or individuals of legitimate investigative interest. 

(U//FOUOH 


b7E 

b7E 


b7E 


8.9 (U) Intelligence Collection (i.e., Incidental Collection) 


(U//FOUO) Intelligence that is responsive to PFI requirements, FBI national collection 
requirements and FBI field office collection requirements mav be collected incidental tf 
Enterprise Investigation. 


an 


"[(See DIOG Section 15.6.1.2 - Written Intellig ence Products 


(U//FOUO) 


b7E 


b7E 


8.10 (U) Standards for Approving the Closing of an Enterprise 

Investigation 

8.10.1 (U) Standards 

(U//FOUO) At the conclusion of an Enterprise Investigation, each of the following items must be 
documented in the closing communication (EC and/or LHM): 

A) (U//FOUO) A summary of the results of the investigation; 

B) (U//FOUO) Whether logical and reasonable investigation was completed; 

C) (U//FOUO) Whether all investigative methods initiated have been completed and/or 
discontinued; 

D) (U//FOUO) Whether all leads set have been completed and/or discontinued; 

E) (U//FOUO) Whether all evidence has been returned, destroyed or retained in accordance with 
evidence policy; and 
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F) (U//FOUO) A summary statement of the basis on which the Enterprise Investigation will be 
closed, and selection of the appropriate closing status: 

1) (U//FOUO) C-4: Administrative Closing, which includes: 

a) (U//FOUO) No further investigation is warranted because logical investigation and/or 
leads have been exhausted, and the investigation to date did not identify a criminal 
violation or a priority threat to the national security 

b) (U//FOUO) Investigation assigned a new file number, or 

c) (U//FOUO) Investigation consolidated into a new file number or an existing file 
number. 

2) (U//FOUO) C-6: Other Closing, which includes: 

a) (U//FOUO) Enterprise Investigation has been completed; or 

b) (U//FOUO) Any other type of closing 

8. 1 0.2 (U) Approval Requirements to Close 

(U//FOUO) The appropriate closing supervisor described below must review and approve the 
closing communication (as described in Section 8.10.1) to ensure it contains the above-required 
information and sufficient details of the investigation on which to base the decision to close the 
Enterprise Investigation. Although there is no limit on the duration of an Enterprise 
Investigation, the investigation must be closed upon all investigative activity being exhausted. 
The appropriate closing supervisors are: 

A) (U//FOUO) Opened bv a Field Office with FBIHO SC Approval : Closing an Enterprise 
Investigation opened by a field office requires the prior approval of the appropriate FBIHQ 
SC. 

B) (U//FOUO) Opened, bv FBIHQ : Closing an Enterprise Investigation opened by FBIHQ 
requires approval from the appropriate SC and notification to the appropriate field office. 

C) (U//FOUO) SIM Opened bv a Field Office with FBIHQ SC Approval : Closing an Enterprise 
Investigation opened by a field office involving a sensitive investigative matter requires 
approval from the appropriate FBIHQ SC. 

(U//FOUO) SIM Opened bv FBIHQ : Closing an Enterprise Investigation opened by FBIHQ 
involving a sensitive investigative matter requires approval from the SC, and written 
notification to the appropriate field office. 

8.11 (U) Other Program Specific Investigative Requirements 

(U//FOUO) To facilitate compliance with investigative program-specific requirements, the FBI 
employee should consult the relevant division’s PG to ascertain any program-specific 
requirements. No policy or PG may contradict, alter or otherwise modify the standards of the 
DIOG. Requests for DIOG modifications can be made to the Corporate Policy office (CPO) 
pursuant to DIOG Section 3.2.2 paragraphs (A), (B), (C) and (D). 
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9 (U) FOREIGN INTELLIGENCE 


9.1 (U) Overview 

(U) Foreign Intelligence defined : Foreign intelligence is “information relating to the 
capabilities, intentions, or activities of foreign governments or elements thereof, foreign 
organizations, or foreign persons, or international terrorists.” A “Foreign Intelligence 
Requirement” is a collection requirement issued under the authority of the Director of National 
Intelligence (DNI) and accepted by the FBI Directorate of Intelligence (DI). Additionally, the 
President, a United States Intelligence Community (USIC) office designated by the President, the 
Attorney General, Deputy Attorney General, or other designated Department of Justice (DOJ) 
official may levy a foreign intelligence requirement on the FBI. Foreign intelligence collection 
by the FBI is based upon requirements. 

(U//FOUO) Foreign intelligence requirements issued by one of the parties listed above and 
accepted by the FBI DI will fall into one of two categories: (i) those that address national 
security issues that are within the FBI’s core national security mission (FBI collection 
requirements); and (ii) information relating to the capabilities, intentions, or activities of foreign 
governments or elements thereof, foreign organizations, foreign persons, or international 
terrorists which are not within the FBI’s core national security mission (PFI Collection 
Requirements). 

(U//FOUO) Requirements which fall into the first category may correspond to FBI national 
collection requirements as defined in DIOG Section 5.12. FBI national collection requirements 
are addressed in properly authorized Assessments (See DIOG Section 5. 6.3.5) or Predicated 
Investigations. (See the Intelligence Policy Implementation Guide (IPG) for specific 
requirements.) 

(U//FOUO) Requirements which fall into the second category are known as Positive Foreign 
Intelligence (PFI) Collection Requirements and may only be addressed under the authorities 
described in this section. Type 6 Assessments opened for the purpose of determining whether a 
field office has the ability to collect on a PFI Collection Requirement (See DIOG Section 
5 . 63 . 5 ), and Full Investigations opened for the specific purpose of collecting on PFI Collection 
Requirements must be predicated on an established PFI Collection Requirement that has been 
accepted and approved by the FBIHQ Directorate of Intelligence (DI) - Field Intelligence 
Management Section (FIMS), Field Intelligence Management Unit (FIMU) UC. Preliminary 
Investigatio ns for the sole purpose of collecting on PFI requirements are not authorized bv the 
AGG-Dom. 

A Full PFI investigation opened tor tne intended 
purpose ot collecting on PFI requirements must be approved by the FIMU Unit Chief (UC). A 
Full PFI Investigation cannot be opened on oral authority. 

(U//FOUO) “The general guidance of the FBI’s foreign intelligence collection activities by DNI- 
authorized requirements does not limit the FBI’s authority to conduct investigations supportable 
on the basis of its other authorities — to investigate federal crimes and threats to the national 
security — in areas in which the information sought also falls under the definition of foreign 
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intelligence.” (Attorney General’s Guidelines for Domestic FBI Operations (AGG-Dom), 
Introduction A.3) Accordingly, the AGG-Dom authorizes the collection of foreign intelligence 
incidental to predicated crimina l, counterintelligence, counterterrorism, cyber, and weapons of 
mass destruction investigations J 

I See DIOG Sections 5.2 and 7.5. A and B. 

(U//FOUO) A Full PFI Investigation can be opened based solely on a PFI Collection 
Requirement. The authorized purpose (the PFI Collection requirement) must exist and have been 
accepted by the FBI. 

(U) Examples : 



(U//FOUO) FBIHQ DI provides specific guidance in its IPG regarding FBI national collection 
requirements, FBI field office collection requirements, and PFI requirements. 

9.2 (U) Purpose and Scope 

(U//FOUO) As stated above, foreign intelligence is “information relating to the capabilities, 
intentions, or activities of foreign governments or elements thereof, foreign organizations, or 
foreign persons, or international terrorists.” The collection of positive foreign intelligence 
extends the sphere of the FBI’s information-gathering activities beyond federal crimes and 
threats to the national security and permits the FBI to seek information regarding a broader range 
of matters relating to foreign powers, organizations, or persons that may be of interest to the 
conduct of the United States’ foreign affairs. (AGG-Dom, Introduction A.3) 

(U//FOUO) While employees may collect positive foreign intelligence in already opened 
Assessments and Predicated Investigations (incidental collection), this section is focused on the 
policies and procedures that govern opening and managing Full Investigations for the specific 
purpose of collecting on PFI Collection Requirements published by the DI. DIOG Section 
5. 6.3 .4 governs opening and managing Type 6 Assessments. 
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9.3 (U) Civil Liberties and Privacy 

(U) Because the authority to collect positive foreign intelligence pursuant to PFI Collection 
Requirements enables the FBI to obtain information pertinent to the United States’ conduct of its 
foreign affairs, even if that information is not related to criminal activity or threats to the national 
security, the information collected may concern lawful activities. Accordingly, the FBI must 
operate openly and consensually with an US Person (USPER), to the extent practicable, when 
collecting positive foreign intelligence. (AGG-Dom, Introduction A.3) 

(U) The pursuit of legitimate investigative goals without infringing upon the exercise of 
constitutional freedoms is a challenge that the FBI meets through the application of sound 
judgment and discretion. 

(U) No investigative activity, including the collection of positive foreign intelligence pursuant to 
PFI Collection Requirements, may be taken solely on the basis of activities that are protected by 
the First Amendment or on the race, ethnicity, national origin or religion of the subject or a 
combination of only those factors. In order to take action intentionally to collect positive foreign 
intelligence, an FBI employee must open a Full Investigation that is predicated on a PFI 
requirement. 

(U) The AGG-Dom present investigators with a number of authorized investigative methods in 
the conduct of a Full Investigation to collect positive foreign intelligence. Considering the effect 
on the privacy and civil liberties of individuals and the potential to damage the reputation of 
individuals, some of these investigative methods are more intrusive than others. The least 
intrusive method if reasonable based upon the circumstances of the investigation is to be used, 
but the FBI must not hesitate to use any lawful method consistent with the AGG-Dom. For 
further explanation of the least intrusive method refer to DIOG Section 4. 

(U) Moreover, when collecting positive foreign intelligence, as part of a Full Investigation 
predicated on a PFI requirement, the FBI must operate openly and consensually with an USPER, 
to the extent practicable. 

(U) By emphasizing the use of the least intrusive means to collect positive foreign intelligence 
and by emphasizing the need to operate openly and consensually with an USPER, to the extent 
practicable, FBI employees can effectively execute their duties while mitigating the potential 
negative impact on the privacy and civil liberties of all people encountered as part of the 
collection. This principle is not intended to discourage FBI employees from seeking relevant and 
necessary positive foreign intelligence, but rather is intended to make sure FBI employees 
choose the least intrusive — but still reasonable based upon the circumstances of the investigation 
- from the available options to obtain the information. 

(U) The Privacy Act may not exempt from disclosure information the FBI collects during 
Positive Foreign Intelligence Assessments and investigations to qualified U.S. citizens or 
lawfully admitted permanent residents when personally identifying information about such 
persons resides in those files. FBI employees should therefore be particularly vigilant about 
properly classifying any such information and avoiding unnecessary references to, and the 
documentation of, identifying information about U.S. citizens and lawfully admitted permanent 
residents in Positive Foreign Intelligence files. 
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9.4 (U) Legal Authority 

(U) The FBI’s legal authority to collect positive foreign intelligence derives from a mixture of 
administrative and statutory sources. (See E.0. 12333; 50 U.S.C. §§ 401 et seq.; 50 U.S.C. §§ 
1801 et seq.; 28 U.S.C. § 532 note [incorporates the Intelligence Reform and Terrorism 
Protection Act, P.L. 108-458 §§ 2001-2003]). In collecting positive foreign intelligence, the FBI 
will be guided by collection requirements issued under the authority of the DNI, including the 
National Intelligence Priorities Framework and the National Human Intelligence (HUMINT) 
Collection Directives, or any successor directives issued under the authority of the DNI and 
accepted by FBIHQ DI (PFI Collection Requirements). 

9.4.1 (U) Full Investigation Activities 

(U//FOUO) As discussed in Section 7 of the DIOG, the AGG-Dom cites three predication 
circumstances warranting a Full Investigation, one of which specifically applies to the collection 
of positive foreign intelligence: “The Full Investigation may obtain foreign intelligence that is 
responsive to a [positive] foreign intelligence requirement.” 

(U//FOUO) A PFI investigation may only be commenced if the Office of the DNI has levied a 
foreign intelligence collection requirement on the FBI and the DI has accepted the requirement 
as one to which the FBI will endeavor to respond to as part of its PFI Program (i.e., PFI 
Collection Requirements). The FBI is authorized to open a Full Investigation to collect on a 
USIC intelligence requirement only if it has been accepted and designated by FBIHQ DI as a PFI 
Collection Requirement. 

9.5 (U) General Requirements and FBIHQ Standards for Approving the 
Opening of Positive Foreign Intelligence Investigations 

9.5.1 (U) General Requirements and Program Responsibilities 

(U//FOUO) The FIMS is responsible for promulgating FBI policy and oversight of the Foreign 
Intelligence Collection Program (FICP). FIMS, FIMU will provide notice to the DOJ NSD upon 
the opening of a positive foreign intelligence Full Investigation. To ensure that all positive 
foreign intelligence collection is focused on authorized PFI Collection Requirements, only FIMU 
may approve the opening of a Full Investigation | 

I F ield ottices must request by EC to the 

FIMU Unit Chief (UC) approval to open Full Investigations to collect on PFI Collection 
Requirements. 

(U//FOUO)| 


(U//FOUO) The DIOG prohibits the use of control files or administrative files to document 
investigative activity. (See DIOG Appendix J) 


b7E 
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9.5.2 (U) Standards For Opening a Full Investigation to Collect Positive 

Foreign Intelligence 

(U//FOUO) Before opening or approving a Full Investigation for the purpose of collecting PFI, 
the approving official must determine whether: 

A) (U//FOUO) The FBI DI has established an PFI Collection Requirement for opening a Full 
Investigation; 

B) (U//FOUO) The Full Investigation is not based solely on the exercise of First Amendment 
activities or on the race, ethnicity, national origin or religion of the subject or a combination of 
only such factors; and 

C) (U//FOUO) The Full Investigation is an appropriate use of personnel and financial resources. 

(U//FOUO) Additional policies regarding Predicated Investigation involving any foreign 
ambassador, foreign official, foreign student or exchange visitor, protected persons or premises 
as a subject may be found in DIOG Appendix G [No Foreign Policy Objection (NFPO)]. 

9.6 (U) Opening Documentation, Approval, Effective Date, and File 

Review 

9. 6.1 (U) Opening by a Field Office With FBIHQ FIMU UC Approval or 

Opening by FBIHQ 

(U//FOUO) The predication for a Full PFI Investigation must be documented in the opening 
electronic communication (EC). A Full PFI Investigation may not be opened on oral authority. 

9.6.1.1 (U) Approval to Open a Full PFI Investigation 

(U//FOUO) Opened by a Field Office or Opened by FBIHQ : FIMU UC will approve the 
opening of a Full Investigation based on PFI Collection Requirements. 

9.6.1.1.1 (U) Effective Date 

(U//FOUO) Opened by a Field Office or Opened by FBIHQ: The effective date of the Full 
Investigation is the date the FIMU UC approves the EC 


9.6.1.2 (U) Approval to Open a Full PFI Investigation Involving a Sensitive 

Investigative Matter (SIM) 

(U//FOUO) The opening of a Full PFI Investigation involving a SIM: 

9.6.1.2.1 (U) SIM Full PFI Investigation Opened by a Field Office 

(U//FOUO) The opening in a field office of a Full Investigation to collect PFI involving a 
SIM must have prior Chief Division Counsel (CDC) revi ew, and approval by the Special 
Agent in Charge (SAC) and the FIMS Section Chief (SC)| 
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(U//FOUO) The opening by FBIHQ of a Full Investigation t o collect PFI involving a SIM 
must have prior OGC review, and approval by the FIMS SC. I I 


(U//FOUO)! I b7E 


9 . 6 . 1 . 2.3 (U) Effective Date 

(U//FOUO) Opened by a Field Office or Opened by FBIHQ : The effective date of the Full 

Investigation involving a SIM is the date the FIMS SC annroves the F.Cl I , b7E 


9.6.2 (U) Pending Inactive Status 

m//Fouotl ' 


9. 6.3 (U) Notice to DOJ 

9.6.3. 1 (U) For a Full PFI Investigation 

(U//FOUO) Notice to DOJ is required when a Full Investigation to collect information 
responsive to a foreign intelligence requirement is opened. Notice must be forwarded from 
FIMS, FIMU to the DOJ NSD as soon as practicable but no later than 30 calendar days after 
the opening of the investigation. (AGG-Dom, Part II.B.5) For Full PFI Investigations that are 
a SIM, see DIOG Section 9.6. 1.2 above. 
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9. 6.4 (U) Dura tion 

(U//FOUO) A Full PFI Investigation may continue for as long as necessary until the requirement 
is met, or the investigation concludes they cannot satisfy the requirement. 

9 . 6.5 (U) File Review 

9.6.5.1 (U) Full Investigations 

(U//FOUO) Supervisory file reviews of a Full PFI Investigation must be conducted at least 
every 90 days in accordance with DIOG Section 3.4.4. File reviews for probationary agents 
must be conducted at least every 60-days. 

9 . 6. 6 (U) Annual Letterhead Memorandum 

9.6.6.1 (U) Field Office Responsibility 

(U//FOUO) All FIGs must submit an annual report on each Full PFI Investigation that was 
open for any period of time during the previous calendar year. This report is due to FBIHQ 
FIMS no later than January 30th of the calendar year following each year during which a Full 
Investigation is open and must include the following: 

A) (U//FOUO) The PFI requirement to which the investigation was responding; 

B) (U//FOUO) All methods of collection used; 

C) (U//FOUO) All Sensitive Investigative Matters encountered; 

D) (U//FOUO) A list of all IIRs by number issued based on information collected during the 
investigation; 

E) (U//FOUO) A summary of the PFI collected; and 

F) (U//FOUO) The date the Full Investigation was opened and, if applicable, the date it was 
closed. 

(U//FOUO) These reports should be submitted by EC. The EC must be serialized in the FBI’s 
central recordkeeping system as designated in the IPG. 

9.6.6.2 (U) FBIHQ Responsibility 

(U//FOUO) FIMS must compile data from each field office regarding the scope and nature of 
the prior year’s PFI collection program. No later than April 1 st of each year, the FIMS must 
submit a comprehensive report of all activity described above to DOJ NSD. The report must 
include the following information: 

A) (U//FOUO) The PFI requirement to which the investigations were responding; 

B) (U//FOUO) All Sensitive Investigative Matters encountered; and 

C) (U//FOUO) The date all Full Investigation were opened and closed (if applicable). 
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9.7 (U) Standards for Opening or Approving the Use of an Authorized 
Investigative Method in a Full Positive Foreign Intelligence 
Investigation 

(U//FOUO) Prior to opening or approving the use of an investigative method in a Full 
Investigation for the purpose of collecting positive foreign intelligence pursuant to a PFI 
Collection Requirement, an FBI employee or approving official must determine whether: 

A) (U//FOUO) The use of the particular investigative method is likely to further the authorized 
purpose of the Full Investigation; 

B) (U//FOUO) The investigative method selected is the least intrusive method, if reasonable 
based upon the circumstances of the investigation and, if taken relative to an US person 
(USPER), the method involves open and consensual activities, to the extent practicable; 

C) (U//FOUO) Open and consensual activity would likely be successful (if it would, covert non- 
consensual contact with an USPER may not be approved); and 

D) (U//FOUO) The investigative method is an appropriate use of personnel and financial 
resources. 

9.8 (U) Authorized Investigative Methods in a Full Positive Foreign 
Intelligence Investigation 

(U//FOUO) Prior to opening or approving the use of an investigative method, an FBI employee 
and approving official must apply the standards as provided in DIOG Section 9.7. With the 
exceptions noted below, all lawful methods may be used during a Full Investigation to collect 
positive foreign intelligence pursuant to PFI Collection Requirements. If actions are to be taken 
with respect to an USPER, the method used must be open and consensual, to the extent 
practicable. 

(U) See DIOG Section 18 for a complete description of the following methods that may be used 
in Full PFI Investigations. The methods are: 

A) (U) Public information. (See Section 18.5.1) 

B) (U) Records or information - FBI and DOJ. (See Section 18.5.2) 

C) (U) Records or information - Other federal, state, local, tribal, or foreign government agency. 
(See Section 18.5.3) 

D) (U) On-line services and resources. (See Section 18.5.4) 

E) (U) CHS use and recruitment. (See Section 18.5.5) 

F) (U) Interview or request information from the public or private entities. (See Section 18.5.6) 

G) (U) Information voluntarily provided by governmental or private entities. (See Section 18.5.7) 

H) (U) Physical Surveillance (not requiring a court order). (See Section 18.5.8) 

I) (U) Trash Covers (Searches that do not require a warrant or court order). (Section 18.6.12) 

J) (U) Consensual monitoring of communications, including electronic communications. 
(Section 18.6.1) 
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(U//FOUOJ 


(U//FOUO) See the classified provisions in Appendix G for additional information. 

K) (U) Intercepting the communications of a computer trespasser. (Section 18.6.21 

L) (U) Closed-circuit television/video surveillance, direction finders, and other monitoring 
devices. (Section 18.6.3^) 

M) (U) Polygraph examinations. (Section 18.6.1 11 

N) (U) Undercover Operations (Section 18.6.13! 

O) (U//FOUO) Pen registers and trap/trace devices for non-USPERs using FISA. (See Section 
18.6.9! 

P) (U) Electronic surveillance using FISA or E.O. 12333. (See Section 18.7.31 

Q) (U//FOUO) Searches - with a warrant or court order using FISA or E.O. 12333 § 2.5. The 
DIOG classified Appendix G provides additional information regarding certain searches. 
(AGG-Dom, Part V.A. 12) (See Section 18.7.11 

R) (U) FISA Title VII - Acquisition of positive foreign intelligence information. (See Section 
18.7.31 

S) (U//FOUO) FISA Order for business records (for records relating to a non-USPER only). (See 
Section 1 8.6.71 

9.9 (U) Investigative Methods Not Authorized During A Full Positive 

Foreign Intelligence Investigation 

(U//FOUO) The following investigative methods are not permitted to be used for the purpose of 
collecting positive foreign intelligence pursuant to PFI Collection Requirements: 

A) (U//FOUO) National Security Letters (15 U.S.C. §§ 1681u, 168 lv; 18 U.S.C. § 2709; 12 
U.S.C. § 341 [a] [5] [A]; 50 U.S.C. § 436). (Section 18.6.61 

B) (U//FOUO) FISA Order for business records (for records relating to an USPER). (Section 
18.6.71 

C) (U//FOUO) Pen registers and trap/trace devices in conformity with FISA (on an USPER). 
(Section 18.6.91 

D) (U//FOUO) Pen registers and trap/trace devices in conformity with chapter 206 of 18 U.S.C. 
§§3121-3 127. (Section 18.6.91 

E) (U//FOUO) Mail covers. (Section 18.6.101 

F) (U//FOUO) Grand jury subpoenas. (Section 18.6.51 

G) (U//FOUO) Administrative subpoenas. (Section 1 8.6.41 
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H) (U//FOUO) Stored wire and electronic communications and transactional records. (Section 
18 . 6.81 

9.10 (U) Sensitive Investigative Matters (SIM) in a Full Positive Foreign 

Intelligence Investigation 

(U//FOUO) The title/caption of the opening or subsequent EC for a Full Investigation for the 
collection of PFI involving a SIM must contain the words “Sensitive Investigative Matter.” 
DIOG Section 10 contains the required approval authorities and factors to be considered relative 
to a Predicated Investigation involving a SIM. 

9.10.1 (U) Sensitive Investigative Matters (SIM) 

(U//FOUO) A SIM is an investigative matter involving the activities of a domestic public official 
or domestic political candidate (involving corruption or a threat to the national security), 
religious or domestic political organization or individual prominent in such an organization, or 
news media, an academic nexus, or any other matter which, in the judgment of the official 
authorizing an investigation, should be brought to the attention of FBIHQ and other DOJ 
officials. (AGG-Dom, Part VII.N.) As a matter of FBI policy, “judgment” means that the 
decision of the authorizing official is discretionary. DIOG Section 10 and/or the classified 
provisions in DIOG Appendix G define domestic public official, political candidate, religious or 
political organization or individual prominent in such an organization, and news media. 

(U//FOUO) All Full PFI Investigations involving a SIM must be reviewed by the CDC/OGC, 
approved by the SAC and the FIMS SC. 


9.10.2 (U) Academic Nexus 



(U//FOUO) The sensitivity related to an academic institution arises from the American tradition 
of “academic freedom” (e.g., an atmosphere in which students and faculty are free to express 
unorthodox ideas and views and to challenge conventional thought without fear of repercussion). 
Academic freedom does not mean, however, that academic institutions are off limits to FBI 
investigators in pursuit of information or individuals of legitimate investigative interest. 


(U//FOUO: 



in DiUU Appendix (jr. 
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9.11 (U) Retention of Information 

(U//FOUO) FIMS must maintain a database or records systems that permits the prompt retrieval 
of the status of each positive foreign intelligence collection Full Investigation (open or closed), 
the dates of opening and closing, and the basis for the Full Investigation. 

9.12 (U//FOUO) Standards for Approving the Closing of a Full Positive 
Foreign Intelligence Investigation 

9.12.1 (U) Standards 

(U//FOUO) At the conclusion of a Full positive foreign intelligence Investigation, each of the 
following items must be documented in the closing communication (EC and/or LHM): 

A) (U//FOUO) A summary of the results of the investigation; 

B) (U//FOUO) Whether logical and reasonable investigation was completed (i.e. the matter 
acquired the positive foreign intelligence information sought); 

C) (U//FOUO) Whether all investigative methods initiated have been completed and/or 
discontinued; 

D) (U//FOUO) Whether all leads set have been completed and/or discontinued; 

E) (U//FOUO) Whether all evidence has been returned, destroyed or retained in accordance with 
evidence policy; and 

F) (U//FOUO) A summary statement of the basis on which the foreign intelligence investigation 
will be closed, and the selection of C-4 for Administrative Closing, which includes: 

1) (U//FOUO) No further investigation is warranted and/or leads have been exhausted; 

2) (U//FOUO) Investigation assigned a new file number; or 

3) (U//FOUO) Investigation consolidated into a new file number or an existing file number. 

9.12.2 (U) Approval Requirements 

(U//FOUO) The appropriate closing supervisor described below must review and approve the 
closing communication (as described in Section 9.12.1) to ensure it contains the above-required 
information and sufficient details of the investigation on which to base a decision to close the 
foreign intelligence investigation. The appropriate closing supervisors are: 

9.12.2.1 (U) Opened by a Field Office with FBIHQ Approval 

(U//FOUO) Closing a Full PFI Investigation opened by a field office requires a written 
request from the FIG SSA and the approval of the FIMU UC. 

9.12.2.2 (U) Opened by FBIHQ 

(U//FOUO) Closing a Full PFI Investigation opened by FBIHQ requires approval from the 
FIMU UC and notification to the appropriate field office. 
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9.12.2.3 (U) SIM Opened by a Field Office with FBIHQ Approval 

(U//FOUO) Closing a PFI Full Investigation opened by a field office involving a SIM requires 
approval from the SAC and the FIMS SC. 

9.12.2.4 (U) SIM Opened by FBIHQ 

(U//FOUO) Closing a PFI Full Investigation opened by FBIHQ involving a SIM requires 
approval from the FIMS SC, and written notification to the appropriate field office. 

9.13 (U) Other Program Specific Investigation Requirements 

(U//FOUO) To facilitate compliance with investigative program-specific requirements, the FBI 
employee should consult the relevant division’s PG to ascertain any program-specific 
requirements. No policy or PG may contradict, alter or otherwise modify the standards of the 
DIOG. Requests for DIOG modifications can be made to the Corporate Policy office (CPO) 
pursuant to DIOG Section 3.2.2 paragraphs (A), (B), (C) and (D). 
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10 (U//FOUO) SENSITIVE INVESTIGATIVE MATTER (SIM) AND 
SENSITIVE OPERATIONS REVIEW COMMITTEE (SORC) 


10.1 (U) Sensitive Investigative Matters (SIM) 

10.1.1 (U) Overview 

(U) Certain investigative matters should be brought to the attention of FBI management and 
Department of Justice (DOJ) officials because of the possibility of public notoriety and 
sensitivity. Accordingly, Assessments and Predicated Investigations involving “sensitive 
investigative matters” have special approval and reporting requirements. 

10.1.2 (U) Purpose, Scope, and Definitions 

10.1.2.1 (U) Definition of Sensitive Investigative Matters (SIM) 

(U//FOUO) A sensitive investigative matter (SIM) is defined as an investigative matter 
involving the activities of a domestic public official or domestic political candidate (involving 
corruption or a threat to the national security), a religious or domestic political organization or 
individual prominent in such an organization, or the news media; an investigative matter 
having an academic nexus; or any other matter which, in the judgment of the official 
authorizing the investigation, should be brought to the attention of FBI Headquarters (FBIHQ) 
and other DOJ officials. (Attorney General’s Guidelines for Domestic FBI Operations (AGG- 
Dom), Part VII.N.) As a matter of FBI policy, “judgment” means that the decision of the 
authorizing official is discretionary. 

(U//FOUO) The phrase “ investigative matter involving the activities of” is intended to focus 
on the behaviors and/or activities of the subject, target, or subject matter of the Assessment or 
Predicated Investigation. The phrase is generally not intended to include a witness or victim in 
the Assessment or Predicated Investigation. This definition does not, however, prohibit a 
determination that the status, involvement, or impact on a particular witness or victim would 
make the Assessment or Predicated Investigation a SIM under subsection 10.1.2.2.7 below. 

10.1.2.2 (U) Definitions/Descriptions of SIM Officials and Entities 

(U) Descriptions for each of the officials and entities contained in the SIM definition are as 
follows: 

10.1.2.2.1 (U) Domestic Public Official 

(U//FOUO) A domestic public official is an elected official or an appointed official serving in 
a judicial, legislative, management, or executive-level position in a Federal, state, local, or 
tribal government entity or political subdivision thereof. A matter involving a domestic public 
official is a SIM if the Assessment or Predicated Investigation involves corruption or a threat 
to the national security. 
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(U//FOUO) This definition is intended to exclude lower level positions and most line 
positions, such as a patrol officer or office secretary from the SIM category, but it does 
include supervisory personnel (e.g., police Sergeant or Lieutenant). The SIM definition also 
eliminates the “position of trust” language. 

1 0.1.2.2.2 (U) Domestic Political Candidate 

(U//FOUO) A domestic political candidate is an individual who is seeking election to, or 
nomination for election to, or who has authorized others to explore on his or her behalf the 
possibility of election to an office in a federal, state, local or tribal governmental entity or 
political subdivision thereof. As with domestic public officials, a matter involving a political 
candidate is a SIM if the Assessment or Predicated Investigation involves corruption or a 
threat to the national security. 

10.1.2.2.3 (U) Domestic Political Organization or Individual Prominent in such an 

Organization 


(U//FOUO) 


1 0.1.2.2.4 (U) Religious Organization or Individual Prominent in such an 

Organization 


(U//FOUO) 


10.1.2.2.5 (U) Member of the News Media ora News Organization 


(U//FOUO) 


(U//FOUO) 
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(U//FOUO) Examples of news media entities include television or radio stations broadcasting 
to the public at large and publishers of newspapers or periodicals that make their products 
available to the public at large in print form or through an Internet distribution. A freelance 
journalist may be considered to be a member of the media if the journalist has a contract with 
the news entity or has a history of publishing content. Publishing a newsletter or operating a 
website does not by itself qualify an individual as a member of thiemedia. Businesses, law 
firms, and trade associations offer newsletters or have websites; these are not considered news 
media. As the term is used in the DIOG, “news media” is not intended to include persons and 
entities that simply make information available. Instead, it is intended to apply to a person or 
entity that gathers information of potential interest to a segment of the general public, uses 
editorial skills to turn raw materials into a distinct work, and distributes that work to an 
audience, as a journalism professional. 

(U//FOUO) If there is doubt about whether a particular person or entity should be considered 
part of the “news media.” the doubt should be resolved in favor of considering the person or 
entity to be the “news media .” 

(U//FOUO) See the classified provisions in DIOG Appendix G for additional guidance on 
SIMs. 


10.1.2.2.6 (U) Academic Nexus 


(U//FOUQ 1 


A 


(u//Fouq 


B) (U//FOUOJ 


(U//FOUO) The sensitivity related to an academic institution arises from the American 
tradition of “academic freedom” (i.e., an atmosphere in which students and faculty are free to 
express unorthodox ideas and views and to challenge conventional thought without fear of 
repercussion). Academic freedom does not mean, however, that academic institutions are off 
limits to FBI investigators in pursuit of information or individuals of legitimate investigative 
interest. 


(U//FOUO; 
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1 0.I.2.2. 7 (U) Other Matters 

(U//FOUO) Any matter that in the judgment of the official authorizing an investigation should 
be brought to the attention of FBIHQ and other DOJ officials is also a SIM. As a matter of 
FBI policy, “judgment” means that the decision of the authorizing official is discretionary. 

1 0.1.3 (U) Factors to Consider When Opening or Approving an Investigative 
Activity Involving a SIM 

(U//FOUO) In addition to the standards for approving investigative activity in Sections 5, 6, 7, 8 
and 9, the following factors should be considered by (i) the FBI employee who seeks to open an 
Assessment or Predicated Investigation involving a SIM, as well as by the (ii) Chief Division 
Counsel (CDC) or Office of the General Counsel (OGC) when reviewing such matters, and (iii) 
the approving official when determining whether the Assessment or Predicated Investigation 
involving a SIM should be authorized: 

A) (U//FOUO) Seriousness/severity of the violation/threat; 

B) (U//FOUO) Significance of the information sought to the violation/threat; 

C) (U//FOUO) Probability that the proposed course of action will be successful; 

D) (U//FOUO) Risk of public exposure, and if there is such a risk, the adverse impact or the 
perception of the adverse impact on civil liberties and public confidence; and 

E) (U//FOUO) Risk to the national security or the public welfare if the proposed course of action 
is not approved (i.e., risk of doing nothing). 

(U//FOUO) In the context of a SIM, particular care should be taken when considering whether 
the planned course of action is the least intrusive method if reasonable based upon the 
circumstances of the investigation. 

10.1.4 (U) Opening Documentation, Approval, Notice, Change in SIM Status, 
and Sensitive Potential CHS or Sensitive Characteristic 
Designations in Type 5 Assessments 


(U//FOUO 






(U//FOUO) In a Type 5 Assessment! 

1 




if a sensitive characteristic is an aspect being used 


to identify individuals during the Identification Phase. See DIOG Sections 5.6.3.4.4.1 and 5.7 for 
guidance on “Sensitive Potential CHS” and “Sensitive Characteristic” designations. 
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(U//FOUO) The following are required approval and notification levels for investigative 
activities involving SIMs: 

10.1.4.1 (U) Review and Approval of SIM Assessments By A Field Office 

10.1.4.1.1 (U) Type 1 & 2 Assessments 

(U//FOUO) An FBI employee may open a Type 1 & 2 Assessment, as described in Section 
5.6.3. 1, without prior supervisory approval. A Type 1 & 2 Assessment involving a SIM must 
be reviewed by the CDC and approved by the Special Agent-in-Charge (SAC) as soon as 
practicable, but no later than five (5) business days after the opening to authorize the 
Assessment to continue. 

10.1.4.1.2 (U) Type 3 and 4 Assessments 

(U//FOUO) An FBI employee must obtain the following review and approval to open a Type 
3 and 4 Assessment as a SIM: CDC review and SAC approval. If a SIM arises after the 
opening of a Type 3 or 4 Assessment, the Assessment may continue, but the matter must be 
reviewed by the CDC and approved by the SAC as soon as practicable, but no later than five 
(5) business days after the SIM arises to authorize the Assessment to continue. (See DIOG 
Sections 5.6.3 .2.4 and 5.6.3.3.4.) 

10.1.4.1.3 (U) Type 5 Assessments 

(U//FOUO) An FBI employee must obtain CDC review and the SAC's prior approval to open 
a Type 5 Assessment on a sensitive potential confidential human source (CHS) in the 
evaluation/recruitment phase, or if a sensitive characteristic is being used as an aspect to 
identify individuals in the identification phase. If it is determined after the opening of a Type 

5 Assessment that the individual is a sensitive potential CHS, the Assessment may continue, 
but the matter must be approved by the SAC as soon as practicable, but no later than five (5) 
business days after this determination is made to authorize the Assessment to continue. 

(U//FOUO) See DIOG Sections 5.6.3.4.4.1 and 5.7 for guidance on captioning Type 5 
Assessments involving a “Sensitive Potential CHS” or Sensitive Characteristic.” 

10.1.4.1.4 (U) Type 6 Assessments 

(U//FOUO) An FBI employee must obtain the following review and approval to open a Type 

6 Assessment as a SIM: CDC review, SAC approval, and Field Intelligence Management 
Section Field Intelligence Management Section (FIMS) Section Chief (SC) approval. If the 
SIM arises after the opening of a Type 6 Assessment, the Assessment may continue, but the 
matter must be reviewed by the CDC and approved by the SAC and FIMS SC as soon as 
practicable, but no later than five (5) business days after the SIM arises to authorize the 
Assessment to continue. (See DIOG Section 5.6.3.5.4) 

(U//FOUO) FBIHQ must receive notice and approve all Type 6 Assessments whether or not 
they involve a SIM. 
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10.1.4.2 (U) Notice for SIM Assessments by a Field Office 

(U//FOUO) Notice for SIM Assessments — There is no requirement to notify FBIHQ, DOJ, or 
the United States Attorney (USA) of the opening of an Assessment involving a SIM. (AGG- 
Dom, Part II.B.5.a) 

10.1.4.3 (U) Review and Approval of SIM Predicated Investigations by a Field 
Office 

10.1.4.3.1 (U) Predicated Investigations Involving a SIM 

(U//FOUO) CDC review and SAC approval. (See Sections 6.10 and 7.10) 

10.1.4.3.2 (U) Enterprise Investigations Involving a SIM 

(U//FOUO) CDC review, SAC approval, and SC approval. (See Section 8.6) 

10.1.4.3.3 (U) Positive Foreign Intelligence Full Investigations Involving a SIM 

(U//FOUO) CDC review, SAC approval, and FIMS SC approval. (See DIOG Sections 9.6 and 
9.10) 

10.1.4.4 (U) Notice for SIM Predicated Investigations by a Field Office 

10.1.4.4.1 (U) Notice for SIM Predicated Investigations 

(U//FOUO) The field office must provide written notification (EC and a disseminable LHM) 
to the responsible FBIHQ unit and section within 15 calendar days after the opening of a SIM 
Predicated Investigation. The field office also must notify the appropriate United States 
Attorney’s Office (USAO), in writing, unless such notification is inappropriate under the 
circumstances (e.g., a public corruption investigation of a person who is personally close to 
the Unites States Attorney (USA), or the matter is a counterintelligence or espionage 
investigation. (See the CD PG for details concerning notice in counterintelligence and 
espionage investigations.) If notice is not provided to the USAO under the circumstances 
described above, the field office must explain those circumstances in the written notice to 
FBIHQ. The responsible FBIHQ section must notify, in writing, the appropriate DOJ 
Criminal Division official or NSD official. The notification must be made as soon as 
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10.1.4.4.2 (U) Notice for SIM Enterprise Investigations 

(U//FOUO) See DIOG Section 8.6 for notice requirements. 

1 0.1.4.4.3 (U) Notice for SIM Positive Foreign Intelligence Full Investigations 

(U//FOUO) See DIOG Section 9.9 for notice requirements. 

10.1.4.5 (U) Review and Approval of SIM Assessments Opened by FBIHQ 

10.1.4.5.1 (U) TypeI & 2 Assessments 

(U//FOUO) An FBI employee may open a Type 1 & 2 Assessment, as described in Section 
5.6.3. 1, without prior supervisory approval. An Assessment involving a SIM must be 
reviewed by the OGC and approved by the SC as soon as p racticable, but no later than five (5) 
business days after the opening to continue the Assessment! 


b7E 


10.1.4.5.2 (U) Type 3 and 4 Assessments 

(U//FOUO) An FBI employee must obtain the following revie ws and prior approvals to op en 
a Type 3 or 4 SIM Assessment: OGC review and SC approvall I 


10.1.4.5.3 (U) Type 5 Assessments 

(U//FOUO) An FBI employee must obtain OGC review and his/her SC’s approval to open a 
Type 5 Assessment on a sensitive potential CHS 


10.1.4.5.4 (U) Type 6 Assessments 

(U//FOUO) An FBI employee must obtain the following rev iews and approvals to open a 
Type 6 Assessment as a SIM: OGC review and SC annrovalJ I 
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10.1.4.6 (U) Notice Requirements for SIM Assessments by FBIHQ 

(U//FOUO) There is no requirement to notify DOJ or the United States Attorney of the 
opening of an Assessment involving a SIM (including opening a sensitive potential CHS). 
(AGG-Dom, Part II.B.5.a) 

10.1.4.6.1 (U) Review and Approval of SIM Predicated Investigations by FBIHQ 

10.1.4.6.2 (U) Predicated Investigations Involving a SIM 

(U//FOUO) OGC review and SC approval. (See DIOG Sections 6.7 ,6.10; 7.7 and 7.10) 

10.1.4.6.3 (U) Enterprise Investigations Involving a SIM 

(U//FOUO) OGC review and SC approval. (See DIOG Sections 8.6) 

10.1.4.6.4 (U) Positive Foreign Intelligence Full Investigations Involving a SIM 

(U//FOUO) OGC review and SC approval. (See DIOG Section 9.9) 

10.1.4.7 (U) Notice for SIM Predicated Investigations by FBIHQ 

10.1.4.7.1 (U) Notice forSIM Predicated Investigations 

(U//FOUO) The responsible FBIHQ section must provide written notification (EC and a 
disseminable LHM) to any appropriate field office within 15 calendar days after the opening 
of a SIM Predicated Investigation; the USAO, unless such notification is inappropriate under 
the circumstances, or the matter is a counterintelligence or espionage investigation (See the 
CD PG for details concerning notice in counterintelligence and espionage investigations.); 
and the appropriate DOJ Criminal Division official or NSD official, as soon as practicable, 
but no later than 30 calendar days after the opening of the investigation. If notice is not 
provided to the USAO under the circumstances described above, FBIHQ must explain those 
circumstances in the written notice to the field office(s) and DOJ, 

kn own SIMs involved in the investi gation. See the classified provisions in DIOG Appendix G 
foi 

(U//FOUO)| | 


10.1.4.7.2 (U) Notice for SIM Enterprise Investiga tions 

(U//FOUO) See DIOG Section 8.6 for notice requirements. 

1 0.1.4. 7.3 (U) Notice for SIM Full Positive Foreign Intelligence Investigations 

(U//FOUO) See DIOG Section 9.9 for notice requirements. 
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10.1.4.8 (U) Change in SIM Status 



(U//FOUO) The FBI employee must: 

A ) (U//FOUOI In Type 1 & 2 Assessments : Submit an upda ted FD-71 or Guardian 

j ” The FD-71 or Guardian must be 

approved Dy the supervisor responsible tor the Assessment, reviewed by the CDC, and 

approved by the SAC. No notice to FBIHQ is required. 

B) (U//FOUO) In Type 3 through 6 Assessments : 

1) (U//FOUO) Opened by a Field Office - Submit an EC (for Type 5 Assessments, an EC or a 

successor form in i I that must be approved by the supervisor responsible for the 

Assessment, reviewed by the CDC, and approved by the SAC. No notice to FBIHQ is 
required. 

2) (U//FOUO) Opened by FBIHQ - Submit an EC that must be approved by the appropriate 
UC responsible for the investigation, reviewed by OGC, and approved by the SC. 

C) (U//FOUO) Predicated^ Investigations : 

1) (U//FOUO) Opened by a Field Office - Submit an EC that must be approved by the 
supervisor responsible for the investigation, reviewed by the CDC, and approved by the 
SAC. For Predicated Investigations, notification must be provided to the same FBIHQ 
entities (appropriate Unit and Section) that received notice of the SIM. 

2) (U//FOUO) Opened by FBIHQ - Submit an EC that must be approved by the appropriate 
UC responsible for the investigation, reviewed by OGC, and approved by the SC. 

D) (U//FOUO) Enterprise Investigations : 

1) (U//FOUO) Opened by a Field Office - Submit an EC that must be approved by the 
supervisor responsible for the investigation, reviewed by the CDC, and approved by the 
SAC and the appropriate SC. 

2) (U//FOUO) Opened by FBIHQ - Submit an EC that must be approved by the appropriate 
UC responsible for the investigation, reviewed by OGC, and approved by the SC. 

E) (U//FOUO) Positive Foreign Intelligence Full Investigations : 

1) (U//FOUO) Opened by a Field Office - Submit an EC that must be approved by the 
appropriate supervisor, reviewed by the CDC, approved by the SAC and the appropriate DI 
UC. 

2) (U//FOUO) Opened by FBIHQ - Submit an EC that must be approved by the appropriate 
UC responsible for the investigation, reviewed by OGC, and approved by the DI SC. 
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10.1.4.9 (U) Closing SIM Investigations 

10.1.4.9.1 (U) SIM Assessments Closed by a Field Office 

A) (U//FOUO) Type 1_&_2 Assessments - These SIM Assessments must be closed on the FD-71 
or FD-71 a (Guardian) with approval of the supervisor responsible for the investigation and the 
SAC. (See DIOG Section 5.6.3. 1) 

B) (U//FOUO) Type 3, 4. and 5 Assessments - The closing EC (or successor form in| |for 

Type 5 Assessments) must be approved by the supervisor responsible for the investigation and 
the SAC. (See DIOG Section 5.6.3 .2, 3, and 4) 

C) (U//FOUO) Type 6 Assessments - The closing EC must be approved by the supervisor 
responsible for the investigation, SAC and the DI SC. (See DIOG Section 5.6.3.5) 

10.1.4.9.2 (U) SIM Predicated Investigations Closed by a Field Office 

(U//FOUO) The closing standards, approvals and notice requirements for SIM Predicated 

Investigations, including Enterprise Investigations and foreign intelligence Full 

Investigations, are specified in DIOG Sections 6.12; 7.12; 8.9; and 9.12 above. 

10.1.4.9.3 (U) SIM Assessments Closed byFBIHQ 


A) (U//FOUO) Type 1&_2 Assessments - May be closed on the FD-71 or FD-71 a (Guardian) 
with the approval of the UC responsible for the investigation and his/her SC. 

B) (U//FOUO) Type 3, 4, and 5 Assessments - The closing EC (or successor form ir | ~| for 

Type 5 Assessments) must be approved by the UC responsible for the investigation and 
his/her SC. 

C) (U//FOUO) Type 6 Assessments - The closing EC must be approved by the DI UC responsible 
for the investigation and his/her DI SC. 

1 0.1.4.9.4 (U) SIM Predicated Investigations Closed byFBIHQ 


(U//FOUO) The closing standards, approvals and notice requirements for SIM Predicated 
Investigations, including Enterprise Investigations and Full foreign intelligence investigations, 
are specified in DIOG Sections 6.12; 7.12; 8.9; and 9.12 above. 


1 0.1.5 (U) Distinction Between SIM and Sensitive Circumstance in 

Undercover Operations 

(U//FOUO) The term “sensitive investigative matter,” as used in the DIOG, should not be 
confused with the term “sensitive circumstance,” as that term is used in undercover operations. 
“Sensitive circumstance” relates to an undercover operation requiring FBIHQ approval. A 
comprehensive list of sensitive circumstances for criminal activities is contained in the Attorney 
General’s Guidelines on FBI Undercover Operations and in Section 18 of the DIOG. The 
Criminal Undercover Operations Review Committee (CUORC) and the 


|must review and approve undercover operations that 

involve sensitive circumstances. The policy for undercover operations is described in DIOG 
Section 18.6.13, the Undercover and Sensitive Operations Policy Implementation Guide 
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(USOPG), National Security Undercover Operations Policy Implementation Guide (NSUCOPG), 
and the FBIHQ operational division program implementation guides. 

10.1.6 (U) Distinction Between SIM and Sensitive Undisclosed 

Participation 

(U//FOUO) The term “sensitive investigative matter,” as used in the DIOG, should not be 
confused with “sensitive UDP (undisclosed participation).” The rules regarding “sensitive 
investigative matter” and “sensitive UDP” (see DIOG Section 16.2.3.5), while similar, must be 
applied independently. The SIM designation applies to the overall investigation of which FBI 
and DOJ officials should be aware due to potential public notoriety and sensitivity. Sensitive 
UDP, on the other hand, applies to participation by employees or CHSs in lawful organizations 
that are designated as sensitive. Sensitive UDP can occur in either SIM or non-SIM designated 
investigations because sensitive UDP focuses on the activity (UDP) - not on the type of 
investigation in which it is taking place. Certain investigative or intelligence activity, particularly 
in situations involving academic institutions or student groups, may be covered by one or both 
these rules. The following scenarios demonstrate how these policies are to be applied: 

10.1.6.1 (U) Scenarios 
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(U//FOUO)f 


10.2 (U//FOUO) Sensitive Operations Review Committee 

(U//FOUO) At the request of the Director, a new joint DOJ/ FBI oversight committee, the 
Sensitive Operations Review Committee (SORC), has been established to review and monitor 
certain aspects of FBI investigative activities that are not within the purview of other oversight 
committees, particularly with regard to Assessments. The SORC is described as follows: 

1 0.2.1 (U) Membership and Staffing 

A) (U//FOUO) Chairl 


B) (U) Members: 

1) (U//FOUO) FBI: Assistant Directors or designated Deputy Assistant Directors for the 


2) (U//FOUO) DOJ: Assistant Attorneys General of the I 

land any other appropriate 

representative, given the issue being considered by the SORC. 

C) (U//FOUO) Advisors: The Unit Chief or a designee of the FBI’s Corporate Policy Office 
(CPO) will serve as a policy advisor to the SORC. In addition, DOJ’s Chief Privacy and Civil 
Liberties Officer or a designee will also serve as an advisor to the SORC. 

D) (U//FOUO) Staff: The staff of the SORC shall be from the executive staffs of the Executive 
Assistant Directors of the NSB and the CCSB. Proposals from the NSB shall be handled by its 
executive staff; proposals from CCSB shall be handled by its executive staff. The staffs will 
be collectively referred to here as “SORC Staff.” The SORC Staff is responsible for ensuring 
that FBI and DOJ members of the SORC have the information required to perform their 
SORC duties and are kept fully informed of process developments in matters reviewed by the 
SORC. 

1 0.2.2 (U) Function 

(U//FOUO) The SORC will review and provide recommendations to the Director on matters 
submitted, as described below. 

10.2.3 (U) Review and Recommend a tion 

(U//FOUO) The SORC shall review sensitive activities in the categories described below and 
provide recommendations to the Director, who shall be the approval authority: 


b7E 


b7E 


b7E 


b7E 


Version Dated: 
October 15, 2011 


10-12 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 




' fU//FQUol 


AJ//F0TI0f 


B) (U//FOUOf 


Q 


(U//FOUQf 


UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 




b7E 


b7E 


b7E 


b7E 


b7E 


b7E 


10.2.3.1 (U) Factors to Consider for Review and Recommendation 

(U//FOUO) In addition to factors unique to the proposal being considered, the SORC will 
consider the following in determining whether to recommend that a proposed activity be 
approved: 

A) (U//FOUO | 

B) (U//FQU0 j~ 

C) (U//FOUO) r 

D) (U//FOUOH 
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E ) (U//FOUO) 



1 

F) (U//FOUO| 

1 

°t 

h; 

i) 

10.2.3 

(U//FC 

(U//FOUO)| 

1 

(U//FOUO; 

(U//FOUO] | 

S.2 (U) Process for Review and Recommendation 

>uo: 


(U//FOUOI 1 


A) (U//FOUO) The applicable FBIHQ operational! I 



B) (U//FOUO) Upon receipt of the EC and| Ithe proposal, the 

[ 


C) 

(U//FOUO)| Iprior to a scheduled SORC meeting, the SORC Staff must 



D) (U//FOUO) SORC meetings are to be conducted with the expectation thatl 1 
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E j 

F) 

G' 


(U//FOUO) If there is no consensus among the SORC membersl"" I 


(U//FOUO) Once the SORC has made its recommendation, the SORC Staffl 1 


i CU//FOUO') For each DroDOsal. at the next SORC meeting the SORC Staff] I 


10.2.4 (U) Emergency Authorization 

(U//FOUO') When necessary to 1 ISORC 


10.2.4 

( U//FC 

kl (U) Notice/Oversight Function of SORC 

)UO) To facilitate its ability to 1 I 


A) ('U//FOUO') In al lanv aDoroval to task a 

B) 


(U//FOUO) In e| | any 


C) (U//FOUO) In a 
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1 0.2.5 (U) Logistics 


(U//FOUO) The Executive Assistant Director for the NSB is responsible for all logistical support 
required for the proper functioning of the SORC (i.e., schedule meetings, provide place for 
meetings, draft agendas, record keeping and retention functions, all necessary communications, 
etc.). The CPO and the OGC will assist in establishing the logistical support required for the 


SORC. 
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11 (U) LIAISON ACTIVITIES AND TRIPWIRES 


11.1 (U) Overview 

(U//FOUO) FBI employees are encouraged to engage in liaison with the general public, private 
entities, and with local, state, federal, tribal, and foreign government agencies for the purpose of 
building partnerships. As part of our liaison, community outreach, or investigative/intelligence 
mission, FBI employees may also establish tripwires with public entities, private entities, and 
other governmental agencies. Liaison and tripwire activities or initiatives are mutually beneficial 
for the FBI and the public not only because they help build cooperative relationships and educate 
about suspicious activities or potential threats, but also because they encourage the public to 
contact the FBI should they become aware of such suspicious activities or threats. 

11.2 (U) Purpose and Scope 

(U//FOUO) The FBI is authorized to engage in liaison and tripwire activities. The procedures for 
liaison and setting tripwires, together with documentation and requirements for an Assessment or 
Predicated Investigation, are set forth below. 

11.3 (U) Approval Requirements for Liaison and Tripwires 

(U//FOUO) Conducting liaison and tripwire activities or initiatives do not require approval or the 
opening of an Assessment or Predicated Investigation unless they use an investigative method set 
forth in DIOG Sections 18.5 - 18.7. Liaison and tripwire activities or initiatives may be 
conducted as part of an already-opened Assessment or Predicated Investigation. 

1 1.3.1 (U) Scenario 1 

(U//FOUO) An FBI employee makes contact with a chemical supply company to introduce 
himself/herself and educate the owner about the Bureau’s investigative focus on the illegal use of 
precursor chemicals to make improvised explosive devices. The employee advises the owner to 
contact the FBI if he/she observes any unusual or suspicious purchases of certain precursor 
chemicals. 

(U//FOUO) Response : Such a contact would not require approval or the opening of an 
Assessment or Predicated Investigation because no investigative methods are used to conduct 
this activity. 

11.3.2 (U) Scenario 2 
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1 1.4 (U) Documentation & Records Retention Requirements 

(U//FOUO) The terms “liaison” and “tripwire” have been defined in various ways and may differ 
by FBIHQ division, program, or field office. Not every contact with a member of the public will 
be considered liaison or tripwire activity that needs to be documented. As stated above, 
employees are encouraged to engage and converse with the public as part of their routine FBI 
investigative and intelligence mission. 

(U//FOUO) Often, however, these terms are used and/or defined in a formal policy or EC to 
accomplish a particular investigative or intelligence objective. When an employee is directed by 
a supervisor, FBI policy, or a FBIHQ division to establish a liaison relationship or through an 
overarching tripwire initiative, acquire information or intelligence from a tripwire, that directive, 
as well as the actions taken by the employee, must be documented. If an employee on his or her 
own initiative contacts a member of the public and subsequently determines the contact was a 
liaison or tripwire activity, the contact must be documented using the FD-999. Any questions 
regarding whether the employee’s contact with the public should be documented as liaison or 
tripwire activities should be directed to the employee’s supervisor. The intent of this section is to 
ensure that contacts with the public which are considered to be liaison or tripwire activities be 
documented with the FD-999 into a single database system for tracking and reporting purposes. 

(U//FOUO) When the FD-999 is used to document liaison or tripwire activities, the FD-999 must 
be filed pursuant to either A or B as follows: 

A) (U//FOUO) No Investigative Methods Used : If no investigative methods (DIOG Sections 
18.5 - 18.7) are used in the liaison activity or tripwire, the FD-999 may be serialized into an 
investigative file, intelligence file, control file, or into case number 3 1 9X-HQ-A 14877 18- 
[Division sub-file name]. 

B) (U//FOUO) Investigative Methods Used : If investigative methods (DIOG Sections 1 8.5- 
18.7) are used in the liaison activity or tripwire, the FD-999 must also be serialized in one of 
the following: 

1) (U//FOUO) an Assessment file; 

2) (U//FOUO) a Predicated Investigation file; 

3) (U//FOUO) a domestic police cooperation file (343 classification); 

4) (U//FOUO) a foreign police cooperation file (163 classification); or 

5) (U//FOUO) a technical assistance control file (if only technical assistance is provided). 
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12 (U) ASSISTANCE TO OTHER AGENCIES 


12.1 (U) Overview 

(U//FOUO) Part II of the Attorney General’s Guidelines for Domestic FBI Operations (AGG- 
Dom) authorizes the FBI to conduct investigations in order to detect or obtain information about, 
and prevent and protect against, federal crimes and threats to the national security and to collect 
foreign intelligence. (See DIOG Section 2.) Section 12 does not apply to assistance the FBI may 
provide to other agencies while conducting joint investigations. In such instances, other sections 
of the DIOG dealing with Assessments and Predicated Investigations would apply. 

(U//FOUO) Section 12 specifically addresses those situations in which the FBI has been 
requested or is seeking to provide assistance to other agencies and does not have an open 
substantive Assessment or Predicated Investigation {Note: file classifications related to providing 
assistance using the 343 or 163 file classification series fall within the scope of this Section). Part 
III of the AGG-Dom, Assistance to Other Agencies, authorizes the FBI to provide investigative 
assistance to other federal, state, local or tribal, or foreign agencies when the investigation has 
the same objectives as Part II of the AGG-Dom or when the investigative assistance is otherwise 
legally authorized. Accordingly, FBI employees may provide assistance even if it is not for one 
of the purposes identified as grounds for an FBI investigation or Assessment if providing the 
assistance is otherwise authorized by law. For example, investigative assistance is legally 
authorized in certain contexts to state or local agencies in the investigation of crimes under state 
or local law, as provided in 28 U.S.C. § 530C(b)(l)(M)(i) — violent acts and shootings occurring 
in a “place of public use;” 28 U.S.C. § 540 — felonious killing of state and local law enforcement 
officer; 28 U.S.C. § 540A — violent crime against travelers; 28 U.S.C. § 540B — serial killings, 
and to foreign agencies in the investigation of foreign law violations pursuant to international 
agreements. The FBI may use appropriate lawful methods in any authorized investigative 
assistance activity. 

12.2 (U) Purpose and Scope 

(U) The FBI may provide investigative and technical assistance to other agencies as set forth 
below. 

12 . 2.1 (U) Investigative Assistance 

(U) The AGG-Dom permits FBI personnel to provide investigative assistance to: 

A) (U) Authorized intelligence activities of other United States Intelligence Community (USIC) 
agencies; 

B) (U) Any federal agency in the investigation of federal crimes, threats to the national security, 
foreign intelligence collection, or any other purpose that may be lawfully authorized; 

C) (U) Assist the President in determining whether to use the armed forces pursuant to 10 U.S.C. 
§§ 33 1-33, when authorized by Department of Justice (DOJ), as described in Section 
12.3.2.2.1.1, below; 
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D) (U) Collect information necessary to facilitate public demonstrations and to protect the 
exercise of First Amendment rights and ensure public health and safety, when authorized by 
DOJ and done in accordance with the restrictions described in Section 12.3.2.2.1.2, below; 

E) (U) State or local agencies in the investigation of crimes under state or local law when 
authorized by federal law (e.g., 28 U.S.C. §§ 540 — felonious killing of state and local law 
enforcement officer; 540A — violent crime against travelers; 540B — serial killings); 

F) (U) State, local, or tribal agencies in the investigation of matters that may involve federal 
crimes or threats to national security, or for such other purposes as may be legally authorized; 

G) (U) Foreign agencies in the investigations of foreign law violations pursuant to international 
agreements, and as otherwise set forth below, consistent with the interests of the United States 
(including national security interests) and with due consideration of the effect on any US 
Person (USPER); and 

H) (U) The Attorney General has also authorized the FBI to provide law enforcement assistance 
to state or local law enforcement agencies when such assistance is requested by the governor 
of the state pursuant to 42 U.S.C. § 1050 1 (for example, federal law enforcement assistance 
following Hurricane Katrina). The Attorney General must approve any request for assistance 
under 42 U.S.C. § 10501. 

(U) The procedures for providing investigative assistance, together with the standards, approval, 
notification, documentation, and dissemination requirements are set forth in Sections 12.3, 12.5, 
and 12.6 below. 

12.2.2 (U) Technical Assistance 

(U) The FBI is authorized to provide technical assistance to all duly constituted law enforcement 
agencies, other organizational units of the DOJ, and other federal agencies and to foreign 
governments (to the extent not prohibited by law or regulation). The procedures for providing 
technical assistance, together with the approval, notification, documentation, and dissemination 
requirements are set forth in Sections 12.4, 12.5 and 12.6 below. 

12.3 (U) Investigative Assistance to Other Agencies - Standards, 

Approvals and Notice Requirements 

(U) The FBI may provide investigative assistance to other agencies by participating in joint 
operations and investigative activities with such agencies. (AGG-Dom, Part III.E.l) 

(U//FOUO) Dissemination of information to other agencies must be consistent with Director of 
National Intelligence (DNI) directives, the AGG-Dom, DIOG Section 14, FBI Foreign 
Dissemination Manual, the Privacy Act of 1974, and any applicable memoranda of 
understanding/agreement (MOU/MOA), laws, treaties or other policies. (See Sections 12.5 and 
12.6 below for documentation and dissemination of information requirements.) 

12.3.1 (U) Standards for Providing Investigative Assistance to Other 

Agencies 

(U//FOUO) The determination whether to provide FBI assistance to other agencies is 
discretionary but may only occur if: 
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A) (U//FOUO) The assistance is within the scope authorized by the AGG-Dom, federal laws, 
regulations, or other legal authorities; 

B) (U//FOUO) The investigation being assisted is not based solely on the exercise of First 
Amendment activities or on the race, ethnicity, national origin or religion of the subject or a 
combination of only these factors; and 

C) (U//FOUO) The assistance is an appropriate use of FBI personnel and financial, resources. 

12.3.2 (U) Authority, Approval and Notice Requirements for Providing 

Investigative Assistance to Other Agencies 

(U//FOUO) Investigative assistance that may be furnished to other agencies is described below 
by agency type. 

12.3.2.1 (U) Investigative Assistance to United States Intelligence Community 
(USIC) Agencies 

12.3.2.1.1 (U) Authority 

A) (U//FOUO) The FBI may provide investigative assistance (including operational support) for 
authorized intelligence activities of other USIC agencies. (AGG-Dom, Part III.A) 

B) (U//FOUO) Investigative assistance must be in compliance with interagency MOU/MOA, if 
applicable. For example, specific approval and notification requirements exist for assisting the 
Central Intelligence Agency (CIA) and the Department of Defense (DOD) with domestic 
activities. 

12.3.2.1.2 (U) Approval Requirements 

A ) (U//FOUO)| | 


B) (U//FOUO) Sensitive Investigative Matters (SIM) : Any investigative assistance to other 
USIC agencies involving a SIM requires Chief Division Counsel (CDC)/Office of the General 
Counsel (OGC) review, SAC/Section Chief (SC) approval, and notification, as specified in 
12.3.2.1. 3 .B, below. 

12.3.2.1.3 (U) Notice Requirements 

A) (U//FOUO) General: Notice must be provided for the investigative activity or investigative 
method as specified in the DIOG or applicable MOU/MOAs. 

B) (U//FOUO) Sensitive^ Investigative Matters (SIM) : In addition to the above-required 
approvals, any investigative assistance to USIC agencies involving a SIM requires notification 
to the appropriate FBI Headquarters (FBIHQ) operational Unit Chief (UC) and SC by 
Electronic Communication (EC) as soon as practicable, but no later than 15 calendar days 
after the initiation of the investigative assistance. The appropriate FBIHQ operational unit 


b7E 
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must provide notice to the DOJ Criminal Division or National Security Division (NSD) as 
soon as practicable, but not later than 30 calendar days after the initiation of any investigative 
assistance involving a SIM. 

C) (U//FOUO) Classified Appendix : See the classified provisions in DIOG Appendix G for 
additional notice requirements. 

12.3.2.1.4 (U) Documentation Requirements 

(U//FOUO) Investigative assistance (including expert) to USIC agencies using an 
investigative method, other than those authorized in assessments, must be documented 
with the FD-999, filed and serialized to an appropriate file as specified in Sections 12.5 
and 12.6 below. Division PGs may require specific additional reporting requirements for 
their programs. 

12.3.2.2 (U) Investigative Assistance to Other United States Federal Agencies 

12.3.2.2.1 (U) Authority 

A) (U//FOUO) The FBI may provide investigative assistance to any other federal agency in the 
investigation of federal crimes or threats to the national security or in the collection of positive 
foreign intelligence. (Pursuant to DIOG Section 9, collection of positive foreign intelligence 
requires prior approval from the Collection Management Section (CMS), FBIHQ.) The FBI 
may provide investigative assistance to any federal agency for any other purpose that may be 
legally authorized, including investigative assistance to the United States Secret Service 
(USSS) in support of its protective responsibilities. (AGG-Dom, Part III.B.l) See DIOG 
Section 12.4 below for guidance in providing technical assistance to federal agencies. 

B) (U//FOUO) Investigative assistance must be in compliance with interagency MOU/MOA, if 
applicable. 

12.3 .2.2. 1.1 (U) Actual or Threatened Domestic Civil Disorders 

A) (U) At the direction of the Attorney General, the Deputy Attorney General, or the Assistant 
Attorney General for the Criminal Division, the FBI shall collect information relating to actual 
or threatened civil disorders to assist the President in determining (pursuant to the authority of 
the President under 10 U.S.C. §§ 331-33) whether use of the armed forces or militia is 
required and how a decision to commit troops should be implemented. The information sought 
shall concern such matters as (AGG-Dom, Part III.B.2): 

1) (U) The size of the actual or threatened disorder, both in number of people involved or 
affected and in geographic area; 

2) (U) The potential for violence; 

3) (U) The potential for expansion of the disorder in light of community conditions and 
underlying causes of the disorder; 

4) (U) The relationship of the actual or threatened disorder to the enforcement of federal law 
or court orders and the likelihood that state or local authorities will assist in enforcing those 
laws or orders; and 

5) (U) The extent of state or local resources available to handle the disorder. 
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B) (U) Civil disorder investigations will be authorized only for a period of 30 days, but the 
authorization maybe renewed for subsequent 30 day periods. 

C) (U) The only investigative methods that may be used during a civil disorder investigation are: 

1) (U) Public information (See DIOG Section 18.5.1); 

2) (U) Records or information - FBI or DOJ (See DIOG Section 18.5.2); 

3) (U) Records or information - Other Federal, state, local, or tribal, or foreign governmental 
agency (See DIOG Section 18.5.3); 

4) (U) Online services and resources (See DIOG Section 18.5.4); 

5) (U) Interview or request information from the public or private entities (See DIOG Section 
18.5.6); 

(U//FOUO) Note : Such interviews may only be conducted if the FBI employee 
identifies himself or herself as an FBI employee and accurately discloses the purpose of 
the interview. 

6) (U) Information voluntarily provided by governmental or private entities (See DIOG 
Section 18.5.7); and 

7) (U) Any other methods may be used only if authorized by the Attorney General, the 
Deputy Attorney General, or the Assistant Attorney General for the Criminal Division. 

12.3.2.2. 1 .2 (U) Public Health and Safety Authorities in Relation to 

Demonstrations 

A) (U) At the direction of the Attorney General, the Deputy Attorney General, or the Assistant 
Attorney General for the Criminal Division, the FBI shall collect information relating to 
demonstration activities that are likely to require the federal government to take action to 
facilitate the activities and provide public health and safety measures with respect to those 
activities. The information sought in such an investigation shall be that needed to facilitate an 
adequate federal response to ensure public health and safety and to protect the exercise of First 
Amendment rights, such as: 

1) (U) The time, place, and type of activities planned; 

2) (U) The number of persons expected to participate; 

3) (U) The expected means and routes of travel for participants and expected time of arrival; 
and 

4) (U) Any plans for lodging or housing of participants in connection with the demonstration. 

B) (U) The only investigative methods that may be used in an investigation under this paragraph 
are: 

1) (U) Public Information (See DIOG Section 18.5.1); 

2) (U) Records or information - FBI and DOJ (See DIOG Section 18.5.2); 

3) (U) Records or information - other Federal, state, local, tribal, or foreign government 
agencies (See DIOG Section 18.5.3); 

4) (U) Use online services and resources (See DIOG Section 18.5.4); 

5) (U) Interview or request information from the public or private entities (See DIOG Section 
18.5.6); 
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(U//FOUO) Note : Such interviews may only be conducted if the FBI employee identifies 
himself or herself as an FBI employee and accurately discloses the purpose of the 
interview; 

6) (U) Accept information voluntarily provided by governmental or private entities (See 
DIOG Section 18.5.7); and 

7) (U) Any other methods may be used only if authorized by the Attorney General, the 
Deputy Attorney General, or the Assistant Attorney General for the Criminal Division. 

12.3.2.2.2 (U) Approval Requirements 



B) (U//FOUO) Sensitive Investigative Matters (SIM) : Any investigative assistance to other 
federal agencies involving a SIM requires prior CDC/OGC review and SAC/SC approval, and 
notification, as specified in 12.3.2.2.3.B below. 


12.3.2.2.3 (U) Notice Requirements 

A) (U//FOUO) General: Notice must be provided for the investigative activity or investigative 
method as specified in the DIOG and applicable MOU/MOAs. 

B) (U//FOUO) Sensitive Investigative Matters (SIM} : In addition to the above-required 
approvals, any investigative assistance to another federal agency involving a SIM requires 
notification to the appropriate FBIHQ operational UC and SC by EC as soon as practicable, 
but no later than 15 calendar days after the initiation of the assistance. The appropriate FBIHQ 
operational unit must provide notice to the DOJ Criminal Division or NSD as soon as 
practicable, but not later than 30 calendar days after the initiation of any assistance involving a 
SIM. 

C) (U//FOUO) Classified Appendix : See the classified provisions in DIOG Appendix G for 
additional notice requirements. 

12.3.2.2.4 (U) Documentation Requirements 

(U//FOUO) Investigative assistance (including expert) to other Federal agencies using an 
investigative method, other than those authorized in assessments, must be documented 
with the FD-999, filed and serialized to an appropriate file as specified in Sections 12.5 
and 12.6 below. Division PGs may require specific additional reporting requirements for 
their programs. 

12.3.2.3 (U) Investigative Assistance to State, Local, and Tribal Agencies 

(U) The FBI’s authority to provide investigative assistance to state, local, and tribal law 
enforcement agencies has been addressed in several legal opinions by DOJ’s Office of Legal 
Counsel (OLC). OLC’s formal legal opinions are binding on the FBI and the policies herein thus 
conform to their written opinions. 
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(U) The FBI has substantial authority to assist our domestic law enforcement partners in their 

investigations given the broad range of federal offenses that may be investigated by the FBI! I b7E 


[ This authority was greatly augmented by enactment o f the Investigative 
Assistance fo r ViolenTCrimes Act of 2012 (discussed in paragraph B below) J 


(U)l I b7E 


(U) The FBI may provide investigative assistance to state, local, and tribal agencies only in the 
circumstances described below. 8 

A) (U) Investigations Involving Possible Violations, of Federal Law: The FBI is authorized to 
assist state, local and tribal agencies in the investigation of any matter that may involve federal 
crimes or threats to the national security, except where federal law exclusively assigns 
investigative responsibility to another federal agency. See DIOG Section 2.2.1 above. The 
authority to provide such assistance flows from the statutes and regulations that establish the 
FBI’s jurisdiction. 

(U) Thus, so long as the 'FBI’s federal jurisdictional requirement is fulfilled, the fact that 

violations of state law are also present, or that local authorities are also involved in the 

investigation, is irrelevant. When the FBI assists state, local, or tribal authorities in the course 

of a federal investigation, t he FBI’s investigative efforts (e.g., witness interviews, or ex ecution 

of search or arrest warrants j~ | b7E 


| Of course, there will often be substantial or even complete overlap between the two 
investigations. 

(U) Investigations involving possible violations of state or local law will often involve 
possible violations of federal law as well, permitting the FBI to open an assessment or 
predicated investigation, as appropriate, and provide investigative assistance to state and local 
authorities. Narcotics, carjacking, terrorism, and WMD offenses generally provide a basis for 
FBI assistance, as such violations almost invariably violate federal law. Other frequently 
encountered examples include the following: 

1) (U) Shootings and other crimes committed with firearms may involve violations of the 
federal gun laws, e.g., 18 U.S.C. §§ 922(a)(3)-(4) (transportation across state lines), 922(g) 
(possession by felons, fugitives, illegal aliens, and others); and 922(q) (possession in, on 
the grounds of, or within 1,000 feet of a school). 

2) (U) Assaults and other acts of violence resulting in death or bodily injury may constitute 
hate crimes under 1 8 U.S.C. § 249, or otherwise violate the federal civil rights laws, e.g., 

18 U.S.C. § 245(b) (interference with federally protected activities). 

8 (U) This section addresses the FBI’s authority to provide investigative assistance. For discussion of FBI agents’ 
authority to make warrantless arrests for non-federal felonies and violent misdemeanors committed in their presence, 
see Section 19.3.3 below. 
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3) (U) Armed robberies and threats of physical violence that affect commerce or the 
movement of articles in commerce may involve violations of the Hobbs Act, 

18U.S.C. § 1951. 

4) (U) Murder and certain other state law crimes, when committed in aid of a racketeering 
enterprise or as part of a pattern of racketeering activity, may implicate 18 U.S.C. § 1959 
(violent crimes in aid of racketeering activity) or 18 U.S.C. § 1961-1963 (RICO). 

5) (U) Sex crimes against children that affect commerce or involve cross-border 
transportation or travel may violate the federal sex trafficking statute, 18 U.S.C. § 1591, or 
other federal laws protecting children against sexual exploitation and abuse, e.g., 18 U.S.C. 
§§ 2241(c), 2251-2252A, 2423, and 2425. 

6) (U) Kidnappings violate 18 U.S.C. § 1201(a)(1) if they involve cross-border 
transportation or travel, and federal jurisdiction is presumed to exist 24 hours after the 
abduction (although the FBI may initiate an investigation sooner where there is some 
reasonable indication that a violation of 18 U.S.C. § 1201(a)(1) has been, or is being, 
committed). See 18 U.S.C. § 1201(b). 

7) (U) Hostage taking may violate 18 U.S.C. § 1203(a) where there is reason to believe that 
one of the offenders or victims is a foreign national, or demands are made upon the U.S. 
Government. See 18 U.S.C. § 1203(b)(2). 

8) (U) Transporting stolen vehicles and other stolen goods across state lines may violate 18 
U.S.C. §§2311-2323. 

9) (U) FBI agents are authorized to investigate state law fugitives when there is a , 
reasonable basis to believe that doing so will detect or prevent the commission of any 
federal crime, including violations of the Fugitive Felons Act (FFA), 18 U.S.C. § 1073. 

The FFA makes it a federal crime to move in interstate or foreign commerce with intent to 
avoid prosecution or confinement after conviction in connection with a state felony. FBI 
agents have authority to pursue and arrest fugitives who, in evading arrest, manifest an 
intent to cross state lines (as for example, by traveling on an interstate highway or 
purchasing a bus or airplane ticket to another state), even if they have not yet been detected 
crossing state lines. 

10) (U) Conspiracies to commit these and other federal offenses may violate 
18 U.S.C. §371. 


(U) The FBI may continue to assist state, local and tribal authorities as long as there remains a 



B) (U) Investigations of_ Certain N on-Federal Violations : At the request of an appropriate state 
or local law enforcement official, 9 the FBI is authorized by federal statute to assist in the 
investigation of the following crimes: 


9 

(U) The authorities described in paragraph B of Section 12.3.2.3 address requests for assistance by state and local 
officials only. Other federal law permits the FBI to conduct or assist in investigations in Indian Country. See 18 
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1) (U) Violent acts and shootings occurring in a place of public use. “Place of public use” is 
defined broadly as “those parts of any building, land, street, waterway, or other location 
that are accessible or open to members of the public, whether continuously, periodically, or 
occasionally,” and expressly encompasses “any commercial, business, cultural, historical, 
educational, religious, governmental, entertainment, recreational, or similar place that is so 
accessible or open to the public.” See Investigative Assistance for Violent Crimes Act of 
2012, Pub. Law 1 12-265 (to be codified at 28 U.S.C. 530C(b)(l)(M)(i)) and A.G. Order 
3365-2013. Investigative Assistance provided under this authority must utilize file 
classification 356E. 

2) (U) Mass killings: defined as three or more killings in a single incident and attempted 
mass killings. See Investigative Assistance for Violent Crimes Act of 2012, Pub. Law 1 12- 
265 (to be codified at 28 U.S.C. 530C(b)(l)(M)(i)) and A.G. Order 3365-2013. 

3) (U) Serial killings: defined as a series of three or more killings having common 
characteristics. See 28 U.S.C. § 540B. 

4) (U) Felony killings of state and local law enforcement officers. See 28 U.S.C. § 540. 

5) (U) Felony crimes of violence against travelers: “travelers” is defined as victims who do 
not reside in the State where the crime occurred. See 28 U.S.C. § 540A. 

(U) Prior to conducting any investigative activity under the authority of one of the above listed 
federal statutes, a Predicated Investigation must be opened. An applicable PG can provide 
additional guidance on procedures to follow. Investigative Assistance provided under 
12.3.2.3.B.1 (violent acts and shootings occurring in a place of public use) above, must utilize 
file classification 356E to document all activities associated with the investigative assistance. 

(U) FBI personnel providing assistance under the authority of one of these federal statutes 
may participate in the execution of state-i ssued process (following whatever FBI approval 
process is required for such participation)] I 

b7E 


I I see Section 19.3.3 below. ' 

C) (U) Crime Emergencies atuj Major Disasters: The FBI may provide certain law enforcement 
assistance to states when acting pursuant to the following limited emergency authorities. 

1) (U) Crime Emergencies : Under the Emergency Federal Law Enforcement Assistance 
provisions of the Justice Assistance Act of 1984, 42 U.S.C. § 10501 et seq . (“EFLEA”), the 
Attorney General may provide federal law enforcement assistance at the request of a 
Governor of a state during a law enforcement emergency, when state and local resources 
are insufficient to maintain public safety and security. Such assistance may include funds, 
equipment, training, intelligence information, and personnel. 42 U.S.C. § 10502(1). 

2) (U) Major Disasters: Under the Robert T. Stafford Disaster Relief and Emergency 
Assistance Act, 42 U.S.C. §§ 5121-5208 (“Stafford Act”), the President may direct federal 
personnel, including federal law enforcement officers, to undertake various activities in 
support of state and local authorities in the event of any “major disaster.” 

(U) Where the Attorney General directs federal officers to assist in the enforcement of state 
criminal law pursuant to the EFLEA, or federal officers are properly carrying out disaster 
relief in a local community pursuant to a Stafford Act deployment, they should, if possible, 
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be deputized under state law to act as state peace officers.! I 


D) (U) Laboratory and Other Expert Assistance: The FBI is authorized to provide laboratory 
and certain other expert assistance to state, local, and tribal law enforcement agencies upon 
request, even when no federal crimes are possibly involved. 


1 ) (IT) The FBI laboratories are authorized to provide technical and scientific assistance, 

fo all duly constitute d law enforcement agencies. This 

authority extends to FBI field office personnel on| 


Jhe FBI’s 


authority and procedures tor providing laboratory assistance are set forth in more detail in 
Section 12.4 below and in relevant policy implementation guides and policy directives. 


2) (U) In addition, the FBI is authorized to provide the assistance of expert personnel to 
support state, local, and tribal law enforcement agencies “when lives are endangered,” 
Exec. Order 12333 § 2.6(c), provided that such assistance is either approved by the FBI 
GC or in accordance with written guidelines approved by the FBI GC. See id; A.G. Order 
No. 2954-2008. Thus, even when the FBI lacks any other basis of authority, FBI expert 
personnel may respond to request s for expert assistance bv local authorities in situations 
involving the safety of human life| 


3) (U) Finally, the FBI may provide certain limited non-laboratory expert assistance pursuant 
to its authority to “assist in conducting, at the request of a State [or] unit of local 
government. . . local and regional training programs for the training of State and local 
criminal justice personnel engaged in the investigation of crime and the apprehension of 
criminals.” 42 U.S.C. § 3771(a)(3). While such training typically takes place at the 



b7E 


b7E 


b7E 


b7E 


b7E 
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To come within this authority, the state or local agency requesting assistance must be 
brought into the planning and execution of the FBI’s investigative efforts, and FBI 
personnel must provide their state or local counterparts with a thorough briefing and/or 
debriefing regarding procedures and techniques being used. Moreover, where local 
officials are sufficiently qualified to act, the authority to provide training cannot justify FBI 
involvement in a violation of local law. 

(U)[ 


12.3.2.3.1 (U) Approval Requirements 

A) (U) General: Requests for assistance based on Section 12.3.2.3.B.1 above must be approved 
pursuant to the FBI Director’s Delegation of Authority Memorandum, dated March 14, 2013, 
which delegates the approval authority. This delegated authority may not be redelegated. 

(U) Requests made to Field Offices: Any ADIC or SAC; and 

(U) Requests made to FBIHQ: The Deputy Director, the Associate Deputy Director, the 
Executive Assistant Director for the Criminal, Cyber, Response and Services Branch, the 
Assistant Director for the Criminal Investigations Division, the Assistant Director for the 
Critical Incident Response Group, the Executive Assistant Director for the National Security 
Branch, the Associate Executive Assistant Director for the National Security Branch, the 
Assistant Director of the Counterterrorism Division, and the Assistant Director for the 
Weapons of Mass Destruction Division 

(U) Requests for investigative assistance based on Section 12.3.2.3.A, or 12.3.2.3.B.2 through 
B.5 above, must be approved pursuant to the requirements specified in DIOG Sections 6.7 or 
7.7. 

(U) Request for investigative assistance based on Section 12.3.2.3.C above, must be approved 
by the Attorney General. 

B) (U) Non-Laboratory Expert Assistance: Investigative assistance based on Section 
12.3.2.3 .D.2 above must be approved in accordance with approval guidelines contained in an 
applicable PG or Policy Directive or, if no such guidelines exist, in advance by the FBI GC, 
except that if the FBI GC cannot be contacted through reasonable means, emergency approval 
may be granted by the ADIC/SAC in the field office (or the FBIHQ SC if the request is 
received at FBIHQ) in accordance with this policy, with notification to the GC as soon as 
practicable but no later than 5 business days. If the request for investigative assistance is based 
on Section 12.3.2.3 .D.3 above and it is not covered by an existing PG or Policy Directive, the 
ADIC/SAC in the field office or the FBIHQ SC, as appropriate, may approve the request in 
accordance with this policy, with notification to the GC as soon as practicable but no later than 
5 business days. 

C) (U) Assistance based on Section 12.3.2.3.D.2 or 12.3.2.3.D.3 may be approved solely if the 
following conditions are met: 

1) (U) The head (or designee) of the state, local or tribal law enforcement agency has 
submitted a. written request (including by email) to the FBI that identifies the need for 
specific expertise from the FBI and either: 

a) (U) articulates how lives are endangered (assistance based on Section 12.3.2.3.D.2); or 
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b) (U) represents that the agency does not have available employees with the needed 
expertise or that the employees who do have the needed expertise are not sufficiently 
well trained to handle the immediate situation (assistance based on Section 
12.3.2.3.D.3). 

(U) Note: If due to the exigency of the situation there is not time for the request to be 
submitted in writing, the request may be made orally. Any such oral request must be 
followed by a written request as soon as practicable, but no later than five (5) business 
days. 

2) (U) The CDC, who is encouraged to consult with the FBI GC or attorneys in the 
Investigative Law Unit, OGC (ILU), has reviewed the request and concluded and 
documented that providing the requested assistance is consistent with this policy and does 
not create a significant risk of civil liability to the FBI or the individual employee. If the 
CDC assesses that the assistance will create a substantial risk of civil liability, the CDC 
must consult with OGC. 

' 3) (U) The requesting agency is acting in the lawful execution of an authorized function of 

that organization. 

4) (U) The loan of FBI personnel is an appropriate use of personnel and financial resources 
and does not jeopardize any ongoing FBI investigation. 

12.3.2.3.2 (U) Notice Requirements 

A) (U//FOUO) General: Notice must be provided for the investigative activity or investigative 
method as specified in the DIOG, and applicable MOU/MOAs and/or treaties. 

B) (U//FOUO) Sensitive Investigative Matters (SIM): In addition to the above-required 
approvals, any investigative assistance provided to a state, local, or tribal law enforcement 
agency involving a SIM requires notification to the appropriate FBIHQ operational unit and 
section by EC as soon as practicable, but no later than 15 calendar days after the initiation of 
the assistance. The appropriate FBIHQ operational unit must provide notice to the DOJ 
Criminal Division or NSD as soon as practicable, but not later than 30 calendar days after the 
initiation of any assistance involving a sensitive investigative matter. 

(U//FOUO) Qassified Appendix : See the classified provisions in DIOG Appendix G for 
additional notice requirements. 

12.3.2.3.3 (U) Documentation Requirements 

(U//FOUO) Investigative assistance (including expert) using an investigative method, 
other than those authorized in assessments, must be documented with the FD-999, filed 
and serialized to an appropriate file as specified in Sections 12.5 and 12.6 below. 
Division PGs may require specific additional reporting requirements for their programs. 

12.3.2.3.4 (U) Examples of Expert Assistance in Investigations ofNon-Federal Crimes 


(U//FOUO) Example 1: 
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(U//FOUO) Response 1 J 


(U//FOUO) Example 2f 


(U//FOUOI Response 2: f 


(U//FOUO! Example 3: 
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(U//FOUO) Response 3:1 


12.3.2.4 (U) Investigative Assistance to Foreign Agencies 

(U//FOUO) The foundation of the FBI’s international program is the Legal Attache (LEGAT). 
Each LEGAT is the Director’s personal representative in the foreign countries in which he/she 
resides or has regional responsibilities. The LEGAT’s job is to respond to the FBI’s domestic 
and foreign investigative needs. The LEGAT can accomplish this because he/she develops 
partnerships and fosters cooperation with his or her foreign counterparts on every level and is 
familiar with investigative rules, protocols, and practices that differ from country to country. 
This is the LEGAT’s primary responsibility. As such, foreign agency requests for assistance 
will likely come to the FBI through the LEGAT or International Onerations Division fTODY 


12.3.2.4.1 (U) Authorities 

A) (U//FOUO) At the request of foreign law enforcement, intelligence, or security agencies, the 
FBI may conduct investigations or provide assistance to investigations by such agencies, 
consistent with the interests of the United States (including national security interests) and 
with due consideration of the effect on any US person (USPER). (AGG-Dom, Part III.D. 1) 
The FBI must follow applicable MOUs and MOAs (to include those with other US 
Government (USG) agencies), Mutual Legal Assistance Treaties (MLAT), Letters Rogatory, 
and other treaties when it provides assistance to foreign governments. 
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C) (U//FOUO) The FBI may not provide assistance to a foreign law enforcement, intelligence, or 
security officer conducting an investigation within the United States unless such officer has 
provided prior written notification to the Attorney General of his/her status as an agent of a 
foreign government, as required by 18 U.S.C. § 951. (AGG-Dom, Part III.D.2) The 
notification required by 18 U.S.C. § 95.1 is not applicable to diplomats, consular officers or 
attaches. 


D) (U//FOUO) Upon the request of a foreign government agency, the FBI may conduct 

background inquiries concerning individuals whose consent is documented. (AGG-Dom, Part 
III.D.3) 

12.3.2.4.2 (U) Approval Requirements 

A) (U//FOUO) When a request to assist a foreign agency is received from a LEGAT or IOD, and 
such assistance will require the use of investigative methods other than those that are 
authorized in Assessments, prior SSA approval must be obtained and documented as specified 
in 12.3.2.4.4 below. 

B) (U//FOUO) If a request for assistance is received directly from a foreign law enforcement or 
intelligence service and is not processed through a LEGAT or IOD, written notification 
documenting the foreign assistance request must be provided to the appropriate LEGAT and 
IOD by the FD-999, an EC or Lead Request form, and IOD must grant approval prior to 
providing assistance, regardless of what investigative methods are used. (See also classified 
provisions in DIOG Appendix G) 

C) (U//FOUO) The Office of International Affairs (OIA) in the DOJ’s Criminal Division, has the 
responsibility and authority for the execution of all foreign assistance requests requiring 
judicial action or compulsory process. FBI IOD must coordinate all such requests with the 
DOJ OIA. (See DAG Memorandum, dated 5/16/201 1, titled “Execution of Foreign Requests 
for Assistance in Criminal Cases.”) 

D) (U//FOUO) Higher supervisory approvals and specific notifications may be required for 
assistance to foreign agencies involving joint operations, SIMs, and using particular 
investigative methods, as noted below and in Sections 10 and 18 of the DIOG, and in division 
PGs. 


E) (U//FOUO) Investigations and assistance conducted overseas, as well as related or official 
foreign travel of FBI personnel, require country clearances and notification to the Chief of 
Mission (COM) or designee. Such overseas investigations and assistance must adhere to the 
supplemental guidance in the IOD PG. 

12.3.2.4.3 (U) Notice Requirements 


A) (U//FOUO) When a foreign assistance request is submitted directly to a LEGAT or IOD by a 
foreign agency or through an FBIHQ-authorized joint task force operation involving foreign 
agencies that has previously been briefed to the LEGAT, IOD has notice of the request and the 
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FBI employee does not need IOD approval prior to providing the assistance. The FBI 
employee must provide IOD and the LEGAT the results of the assistance. 

B) (U) The FBI must notify the DOJ NSD concerning investigation or assistance when: (i) 
FBIHQ’s approval for the activity is required (e.g., FBIHQ approval is required to use a 
particular investigative method); and (ii) the activity relates to a threat to the United States 
national security. The FBIHQ division approving the use of the investigative method must 
notify DOJ NSD as soon as practicable, but no later than 30 calendar days after FBIHQ 
approval (see classified appendix for additional notice requirements). (AGG-Dom, Part 
III.D.l) 

C) (U//FOUO) Classified Appendix : See the classified provisions in DIOG Appendix G for 
additional notice requirements. 

D) (U//FOUO) Sensitive Investigative Matters (SIM) : Any request for investigative assistance to 
a foreign agency involving a SIM requires OGC review and IOD SC approval, and 
notification as specified below. In addition to these approvals, any investigative assistance to a 
foreign agency involving a SIM requires notification to the appropriate FBIHQ operational 
UC and SC by EC with an LHM suitable for dissemination to DOJ as soon as practicable, but 
no later than 15 calendar days after the initiation of the assistance. Additionally, the 
appropriate IOD unit must provide notice to the DOJ Criminal Division or NSD as soon as 
practicable, but not later than 30 calendar days after the initiation of any assistance involving a 
SIM. 


12.3.2.4.4 (U) Documentation Requirements 

(U//FOUO) Investigative assistance to foreign agencies must be documented with an FD- 
999 and serialized to an appropriate file as specified in Sections 12.5 and 12.6 below. 

12.3.2.4.5 (U) Examples 

(U//FOUO) Example li I b7E 


(U//FOUO) Example 2J I 
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12.4 (U) Technical Assistance to Other Agencies - Standards, Authority 
and Approval Requirements 

(U//FOUO) Certain FBI technical assistance may be provided to certain other agencies when: 

A ) (U//FOUOH 


BHy//FOUO][ 


C) (U//FOUO T 


12 . 4.1 (U) Authority 

(U//FOUO) Pursuant to 28 C.F.R. §0. 85(g), FBI laboratories, including but not limited to, the 
Laboratory Division, Operational Technology Division’s Digital Evidence Laboratory, and 
Regional Computer Forensic Laboratories, are authorized to provide technical and scientific 
assistance, including expert testimony in federal or local courts, to all duly constituted law 
enforcement agencies, other organizational units of the Department of Justice, and other federal 
agencies (and to certain foreign agencies, see Section 12.4.2.4 below). 

(U//FOUO) Additionally, pursuant to AG Order 2954-2008, the FBI is authorized to provide 
reasonable technical assistance to federal, state, and local law enforcement agencies (and to 
certain foreign agencies, see Section 12.4.2.4 below) to assist such agencies in the lawful 
execution of their authorized functions. 10 Under the Order, such technical assistance includes: 

A) (U) Lending or sharing equipment or property; 

B) (U) Sharing facilities or services; 

C) (U) Collaborating in the development, manufacture, production, maintenance, 
improvement, distribution, or protection of technical investigative capabilities; 

D) (U) Sharing or providing transmission, switching, processing, storage or other services; 

E) (U) Disclosing technical designs, knowledge, information or expertise, or providing 
training in the same; 

F) (U) Providing the assistance of expert personnel in accordance with written 
guidelines issued by the FBI GC or approved by the GC (See Section 12.3.2.3 .D.2 
above); and 


b7E 

b7E 


b7E 


10 (U) AG Order 2954-2008 addresses the FBI’s authority to assist federal, state, local and foreign law enforcement 
agencies only. Other federal law permits the FBI to conduct or assist in investigations in Indian Country. See 18 
U.S.C. § 1 152 (Assimilative Crimes Act) and § 1 153 (Major Crimes Act); Indian Country Policy Implementation 
Guide. 
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G) (U) Rendering other assistance and cooperation to such agencies that is not 
expressly precluded by applicable law. 

12.4.2 (U) Approval Requirements 

12.4.2.1 (U) Technical Assistance to USIC Agencies 

(U//FOUO)! 


12.4.2.2 (U) Technical Assistance to Federal, State, Local and Tribal (Domestic) 

Agencies Regarding Electronic Surveillance, Equipment, and Facilities 

(U) Field-based technical assistance requests under this section must be approved by the field 
office Assistant Director in Charge (ADIC) or SAC in compliance with the Domestic 
Technical Assistance (DTA) PG . If the request for technical assistance involves equipment, 
facilities or property from more than one field office, each field office must approve the use of 
its resources. 


(U) As specified below, FBIHQ senior executive officials and/or officials of the DOJ must 
approve a request for FBI technical assistance that involves: 



D) (U) Assistance to foreign law enforcement agencies (See Section 12.4.2.4 below). 

Jprovides addi tional details specifying the 


(U) The l 

procedures and approval process that must be followed when thj~ 


(U) For technical assistance to foreign law enforcement agencies see Section 12.4.2.4 and the 


b7E 


b7E 
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b7E 

b7E 
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12.4.2.3 (U) Technical Assistance to Federal, State, Local and Tribal (Domestic) 

Agencies Involving Equipment or Technologies Other than Electronic 
Surveillance Equipment 

(U) There are limited other situations in which, in the absence of a federal nexus, a domestic 
law enforcement agency may seek technical assistance through the short term loan of 
equipment from the FBI. If there is an applicable PG or Policy Directive, the policy and 
procedures contained within the PG or Policy Directive must be followed (see, e.g., Corporate 
Policy Implementation Guide: Special Weapons and Tactics . If no PG or Policy Directive 
governs the particular equipment sought to be borrowed and if the loan of the equipment does 
not necessarily also entail the loan of personnel to use or operate the equipment, then the 
ADIC/SAC of the field office must approve the loan of the equipment in accordance with the 
following policy and procedures. If the loan of the equipment necessarily entails the loan of 
FBI employees, the policies governing expert assistance set forth below 
must also be followed. 


(U) Any loan of equipment must be documented through a written agreement between the 
ADIC/SAC and the head of the borrowing law enforcement agency or his/her designee. At a 
minimum, the agreement must provide that the borrowing law enforcement agency will 
reimburse the FBI should the equipment be lost or damaged and that the borrowing law 
enforcement agency will promptly return the equipment when asked to do so by the FBI. If 
due to the exigency of the situation there is not time for the request to be submitted in writing, 
the request may be made orally but must be followed by a written agreement as soon as 
practicable, but not more than five (5) business days following the loan. 


(U) In considering whether to lend the equipment to the federal, state, local and tribal law 
enforcement agency, the ADIC/SAC must take into account the following: 


A) (U) The purpose for which the equipment is being requested and how the equipment will be 
used to advance that objective; 

B) (U) The likelihood that the equipment will be damaged by the requested use; 

C) (U) The likelihood that the field office will need the equipment during the proposed loan 
period; and 


D) (U) Whether the borrowing law enforcement agency has previously violated the terms of any 
loan of equipment or damaged any equipment previously lent by the FBI. 


(U) Fo r technical assistance to foreign law enforc ement agencies see Section 12.4.2.4 below 
and thq 


12.4.2.4 (U) Technical Assistance to Foreign Agencies 

12.4.2.4.1 (U) Authorities 


A) (U//FOUO) The AGG-Dom, Part III.D.4 authorizes the FBI to provide other technical 
assistance to foreign governments to the extent not otherwise prohibited by law. 

B) (U//FOUO) AG Order 2954-2008 authorizes the FBI to provide technical assistance to foreign 
national security and law enforcement agencies cooperating with the FBI in the execution of 
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the FBI’s counterterrorism and counterintelligence duties and to foreign law enforcement 
agencies to assist such agencies in the lawful execution of their authorized functions. Requests 
under this section for technical assistance with respect to electronic surveillance and other 
OTD technologies are to be handled pursuant to the FTA PG. 

12.4.2.4.2 (U) Approval Requirements 


(U//FOUO) Approvals of requests fo r 
handled pursuant to the 


are to be 


12.4.2.4.3 (U) Notice Requirements 


A) (U//FOUO) General: Notice must be provided for the investigative activity or investigative 
method as specified in the DIOG, and applicable MOU/MOAs and/or treaties. 

B) (U//FOUO) Sensitive Investigative Matters (SIM) : In addition to the above-required 
approvals, any investigative technical assistance to the agencies listed in this section involving 
a SIM requires approval by the SAC (HQ assistance requires SC approval) with notification to 
the appropriate FBIHQ operational unit and section and appropriate OTD section by EC as 
soon as practicable, but no later than 15 calendar days after the initiation of the assistance. The 
appropriate FBIHQ operational unit must provide notice to the DOJ Criminal Division or 
NSD as soon as practicable, but not later than 30 calendar days after the initiation of any 
assistance involving a SIM. 

C) (U//FOUO) Qassified Appendix : See the classified provisions in DIOG Appendix G for 
additional notice requirements. 

12.4.2.4.4 (U) Documentation Requirements 


(U//FOUO) All technical assistance rendered must be documented in the appropriate 

case c lassification file, and completed 


accordance with standards and requirements set out in the 


12.5 (U) Documentation Requirements for Investigative Assistance to 

Other Agencies 


12 . 5.1 (U) Documentation Requirements in General 

fU//FQUOfl 


b7E 


b7E 


b7E 


(U//FOUO) When an FD-999 is used to document the “dissemination” of information to another 
agency, it is understood that “assistance” was provided to said agency and a separate FD-999 
does not have to be completed to document the assistance to that agency (domestic or foreign). 
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12.5.2 (U) Documentation Requirements for Investigative Assistance 

(including Expert Assistance) to Other Agencies (Domestic or 

Foreign) 


(U//FOUO) Mandatory use of the FD-999: The FD-999 must be used when providing 


A) (U) | I 

B) (U) [ 

C) (U) l ~l 

P)(u T~ I 

iuz/foupI ~l 


(U//FOUO)[ 



12.5.3 (U) Documentation Requirements for Technical Assistance to Other 

Agencies (Domestic or Foreign) 

(U//FOUO) Th e FBI Domestic Technical Assistance PG and the 

I provide guidance and standardized sample templates and certification documents 
to assist employees on the procedures for providing assistance to domestic and foreign agencies. 
The Domestic Police Cooperation - Technical Assistance (3 43 V s ) case classification and the 

pase classification were created to 

maintain technical assistance documentation. Additionally, technical assistance program 
management related control files may be used in certain circumstances. 

12.6 (U) Dissemination of Information to Other Agencies - Documentation 
Requirements 

(U//FOUO) Dissemination of investigative or intelligence information to other agencies must be 
consistent with Director of National Intelligence directives, the AGG-Dom, DIOG Section 14, 
FBI Foreign Dissemination Manual, the Privacy Act of 1974, and any applicable MOU/MOA, 
law, treaty or other policy. 
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(U//FOUO) Classified information may only be disseminated pursuant to applicable federal law. 

Presidential directive, Attorney General policy and FBI policy. 

(U) The Privacy Act mandates specific documentation of any dissemination of information to an 
agency outside the DOJ involving a U.S. Citizen or alien lawfully admitted for permanent 
residence, i.e., a U.S. person (USPER). 

(U//FOUO) Dissemination of information to foreign agencies must be in accordance with the 
FBI Foreign Dissemination Manual, dated May 23, 2008, or as revised. 

(U//FOUO) Mandatory use of the FD-999 : The FD-999 must be used to document the 
dissemination of all unclassified or classified (up to Secret level) information to: 

A) (U) USIC Agencies; 

B) (U) United States Federal Agencies - when the disseminated information is related to their 
respective responsibilities; 

C) (U) State, Local, or Tribal Agencies - when the disseminated information is related to their 
respective responsibilities; or 

D) (U) Foreign Agencies. 

(U//FOUO) Note : Dissemination of Top Secret or higher classified information must be 
documented in the appropriate classified file or the Sensitive Compartmented Information 
Operational Network (SCION). 

(U//FOUO) Optional use of_ the FD-999 : The FD-999 is permitted, but is not required to be 
used, for the dissemination of information if: 

A) (U//FOUO) the information disseminated is being furnished to an agency within the DOJ with 
which the FBI is working a joint investigation; or 

B) (U//FOUO) the information is disseminated with a document intended for dissemination such 
as an HR, or through another FBI document, such as an official letter, that is maintained in an 
approved database that permits the prompt retrieval information in accordance with DIOG 

Section 12.7.1 below. For examplej | b7E 


12.7 (U) Records Retention Requirements 

12. 7.1 (U) Use of THE FD-999 

(U//FOUO) All FD-999s must be serialized to the appropriate file(s). This requirement allows 
the FBI to maintain a database to comply with the AGG-Dom, Part III.E.3 because it will permit, 
with respect to each such activity, the prompt retrieval of the: 

A) (U) status of the assistance activity (opened or closed); 

B) (U) the dates of opening and closing; and 

C) (U) the basis for the assistance activity. 


Version Dated: 
October 16 2013 


12-22 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 


UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 


§12 


12. 7.2 (U) Serializing theFD-999 for Dissemination of Information 
(U//FOUO) The FD-999 must be serialized to the appropriate file, which may be: 

A) (U) an Assessment file; 

B) (U) a zero sub-assessment file; 

C) (U) a Predicated Investigation file; 

D) (U) a domestic police cooperation file - 343 Classification (the new 343 file classification 
system replaces the former 62 classification) as described below; 

E) (U) a foreign police cooperation file - 163 Classification (the revised 163 file classification 
system) as described below; 

F) (U) a zero classification file; 

G) (U) an unaddressed work file; or 

H) (U) a control file using a unique file number created by the field office, LEGAT, or FBEHQ 
division to document the dissemination of information. 

(U//FOUO) These records will assume the NARA approved retention periods approved for the 
file classification in which they are maintained. 

12.7.3 (U) Serializing the FD-999 for Investigative Assistance 

(U//FOUO) The FD-999 must be serialized to the appropriate file, which may be: 

A) (U) an Assessment file; 

B) (U) a Predicated Investigation file; 

C) (U) a domestic police cooperation file - 343 Classification (the new 343 file classification 
system replaces the former 62 classification) as described below; 

D) (U) a foreign police cooperation file — 163 Classification (the revised 163 file classification 
system) as described below; 

E) (U) a control file using a unique file number created by the field office, LEGAT, or FBIHQ 
division to document investigative assistance to another agency. 

(U//FOUO) These records will assume the NARA approved retention periods approved for the 
file classification in which they are maintained. 

12. 7.4 (U) Request for FD-999 Exemption 

(U//FOUO) FBI entities/programs may submit to the Corporate Policy Office (CPO), Director’s 
Office, a written request for an exemption to the mandatory FD-999 requirements contained in 
DIOG Section 12 provided the entity/program maintains a similar database to permit the prompt 
retrieval of the information required above. The CPO, in conjunction with personnel from the 
Office of Integrity and Compliance (OIC) and the OGC, will evaluate the exemption request to 
determine database compliance with the AGG-Dom. The CPO will approve or deny the 
exemption request, and maintain an exemption list of all approved exempted entities/programs. 
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12. 7.5 (U//FOUO) 343 File Classification - Domestic Police Cooperation 

Files 

(U//FOUO) The former 62 file classification may no longer be utilized to document domestic 
police cooperation. The new 343 file classification system with alpha-designators must be 
utilized to document domestic police cooperation matters. 

12. 7.6 (U//FOUO) 1 63 File Classification - Foreign Police Cooperation 

Files 

(U//FOUO) The 163 file classification was revised with “new” alpha-designators. The 163 file 
classification system must be utilized to document foreign police cooperation matters. 
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13 (U) EXTRATERRITORIAL PROVISIONS 


13.1 (U) Overview 

(U//FOUO) The FBI may conduct investigations abroad, participate with foreign officials in 
investigations abroad, or otherwise conduct activities outside the United States. The guidelines 
for conducting investigative activities outside of the United States are currently contained in: 

A) (U) The Attorney General’s Guidelines for Extraterritorial FBI Operations and Criminal 

Investigations; 

B) (U) The Attorney General ’s Guidelines for FBI National Security Investigations and Foreign 
Intelligence Collection (NSIG, Part HE); 

C) (U) The Attorney General Guidelines on the Development and Operation of FBI Criminal 
Informants and Cooperative Witnesses in Extraterritorial Jurisdictions; 

D) (U) The Attorney General Procedure for Reporting and Use of Information Concerning 
Violations of Law and Authorization for Participation in Otherwise Illegal Activity in FBI 
Foreign Intelligence, Counterintelligence or International Terrorism Intelligence 
Investigations (August 8, 1988); and 

E) (U) Memorandum of Understanding Concerning Overseas and Domestic Activities of the 
Central Intelligence Agency and the Federal Bureau of Investigation (2005). 

(U//FOUO) Collectively, these guidelines and procedures are referred to in the DIOG as the 
Extraterritorial Guidelines. 

13.2 (U) Purpose and Scope 

(U//FOUO) As a general rule, the Extraterritorial Guidelines apply when FBI personnel or 
confidential human sources (CHS) are actively engaged in investigative activity outside the 
borders of the United States. | 


A) (U//FOUO)f 


B) (U//FOUOJ 


C) (U//FOUO; 


D) (U//FOUO)[ 

E) (U//FOUOJ 

F) (U//FOUO)! 
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G) (U//FOUOI 

I b7E 



H) fU//FOUO)l 

| b7E 

1 


I) (U//FOUO] 

' 1 b7E 


1 

J) (U//FOUO)r 

1 b7E 


(U//FOUO) FBI personnel planning to engage in any of the investigative activities described in 
the subsection above must obtain the concurrence of the appropriate Legal Attache (LEGAT) 
and must comply with the remaining procedural requirement of the Extraterritorial Guidelines, 
which may be found in the classified provisions in DIOG Appendix G. 

13.3 (U) Joint Venture Doctrine 

(U//FOUO) The “joint venture” doctrine provides that in certain circumstances, Fourth or Fifth 
Amendment rights may attach and evidence seized overseas, including statements of a defendant, 
may be subject to suppression if the foreign law enforcement officers did not comply with U.S. 
law. A determination that a “joint venture” exists requires a finding of “active” or “substantial” 
involvement by U.S. agents in the foreign law enforcement activity. Because the determination 
will be fact specific and very few cases illuminate what constitutes “active” or “substantial” 
participation, FBI employees should contact their CDC or OGC for guidance. See also Chapter 
35. DOJ Federal Narcotics Manual (March 2011) available on the DOJ intranet. 

13.4 (U) Legal Attache Program 

(U//FOUO) The foundation of the FBI’s international program is the LEGAT. Each LEGAT is 
the Director’s personal representative in the foreign countries in which he/she resides or has 
regional responsibilities. The LEGAT’s job is to respond to the FBI’s domestic and 
extraterritorial investigative needs. LEGATs can accomplish this mission because they have 
developed partnerships and fostered cooperation with their foreign counterparts on every level 
and are familiar with local investigative rules, protocols, and practices which differ from country 
to country. For additional information consult the FBIHQ IOD website . 
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14 (U) RETENTION AND SHARING OF INFORMATION 


14.1 (U) Purpose and Scope 

(U//FOUO) Every FBI component is responsible for the creation and maintenance of authentic, 
reliable, and trustworthy records. (Note: If the originator of information reported to the FBI 
characterizes an individual, group, or activity in a certain way and that characterization should be 
documented for completeness of the FBI record, the FBI record (i.e., 302, EC, LHM, etc.) should 
reflect that another party, and not the FBI, is the originator of the characterization). Without 
complete and accessible records, the FBI cannot conduct investigations, gather and analyze 
intelligence, assist with the prosecution of criminals, or perform any of its critical missions 
effectively. 

(U//FOUO) The FBI is committed to ensuring that its records management program 
accomplishes the following goals: 

A) (U//FOUO) Facilitates the documentation of official decisions, policies, activities, and 
transactions; 

B) (U//FOUO) Facilitates the timely retrieval of needed information; 

C) (U//FOUO) Ensures continuity of FBI business; 

D) (U//FOUO) Controls the creation and growth of FBI records; 

E) (U//FOUO) Reduces operating costs by managing records according to FBI business needs 
and by disposing of unneeded records in a timely manner; 

F) (U//FOUO) Improves efficiency and productivity through effective records storage and 
retrieval methods; 

G) (U//FOUO) Ensures compliance with applicable laws and regulations; 

H) (U//FOUO) Safeguards the FBI’s mission-critical information; 

I) (U//FOUO) Preserves the FBI’s corporate memory and history; and 

J) (U//FOUO) Implements records management technologies to support all of the goals listed 
above. 

14.2 (U) The FBI's Records Retention Plan, and Documentation 

(U//FOUO) The FBI must retain records relating to investigative activities according to the FBI’s 
records retention plan that has been approved by the National Archives and Records 
Administration (NARA). (AGG-Dom, Part VI.A.1) 

(U//FOUO) The FBI’s disposition authorities provide specific instructions about the length of 
time that records must be maintained. In some instances, records may be destroyed after a 
prescribed period of time has elapsed. Other records are never destroyed and are transferred to 
NARA a certain number of years after an investigation is closed. 
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14.2.1 (U) Database or Records System 

(U//FOUO) The FBI must maintain a database or records system that permits, with respect to 
each Predicated Investigation, the prompt retrieval of the status of the investigation (open or 
closed), the dates of opening and closing, and the basis for the investigation. (AGG-Dom, Part 
VI.A.2) 

(U//FOUO) The FBPs official File Classification System covers records related to all 
investigative and intelligence collection activities, including Assessments. Records must be 
maintained in the FBTs Central Records System, or other designated systems of records, which 
provides the required maintenance and retrieval functionality. 

14.2.2 (U) Records Management Division Disposition Plan and Retention 

Schedules 

(U//FOUO) All investigative records, whether from Assessments or Predicated Investigations, 
must be retained in accordance with the Records Management Division Disposition Plan and 
Retention Schedules. No records, including those generated during Assessments, may be 
destroyed or expunged earlier than the destruction schedule without written approval from 
NARA, except in “expungement” circumstances as further described in RMD policy. Records, 
including those generated during Assessments, may not be retained longer than the destruction 
schedule unless otherwise directed by RMD to include, “litigation hold” circumstances as 
described in RMD policy. See the RMD webpage and 

In the event an office believes they need to retain records beyond their destruction schedule, 
they should contact RMD for further guidance. 

14.3 (U) Information Sharing 

(U//FOUO) The FBI 2008 National Information Sharing Strategy (NISS) provides the common 
vision, goals, and framework needed to guide information sharing initiatives with our federal, 
state, local, and tribal agency partners, foreign government counterparts, and private sector 
stakeholders. The FBI NISS addresses the cultural and technological changes required to move 
the FBI to “a responsibility to provide” culture. 

14.3.1 (U) Permissive Sharing 

(U//FOUO) Consistent with the Privacy Act, FBI policy, and any other applicable laws and 
memoranda of understanding or agreement with other agencies concerning the dissemination of 
information, the FBI may disseminate information obtained or produced through activities under 
the AGG-Dom: 

A) (U//FOUO) Within the FBI and to all other components of the DOJ if the recipients need the 
information in the performance of their official duties. 

B) (U//FOUO) To other federal agencies if disclosure is compatible with the purpose for which 
the information was collected and it is related to their responsibilities. In relation to other 
USIC agencies, the determination whether the information is related to the recipient 
responsibilities may be left to the recipient. 
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C) (U//FOUO) To state, local, or Indian tribal agencies directly engaged in the criminal justice 
process when access is directly related to a law enforcement function of the recipient agency. 

D) (U//FOUO) To Congress or to congressional committees in coordination with the FBI Office 
of Congressional Affairs (OCA) and the DOJ Office of Legislative Affairs. 

E) (U//FOUO) To foreign agencies if the FBI determines that the information is related to their 
responsibilities; the dissemination is consistent with the interests of the United States 
(including national security interests); consideration has been given to the effect on any 
identifiable USPER; and disclosure is compatible with the purpose for which the information 
was collected. 

F) (U//FOUO) If the information is publicly available, does not identify USPERs, or is 
disseminated with the consent of the person whom it concerns. 

G) (U//FOUO) If the dissemination is necessary to protect the safety or security of persons or 
property, to protect against or prevent a crime or threat to the national security, or to obtain 
information for the conduct of an authorized FBI investigation. 

H) (U//FOUO) If dissemination of the information is otherwise permitted by the Privacy Act (5 
U.S.C.§ 552a) (AGG-Dom, Part VI.B. 1) 

(U//FOUO) All FBI information sharing activities under this section shall be done in accordance 
with Corporate Policy Directive 12D. “FBI Sharing Activities with Other Government 
Agencies,” and Corporate Policy Directive 95D “Protecting Privacy in the Information Sharing 
Environment,” and any amendments thereto and applicable succeeding policy directives. 

1 4.3.2 (U) Required Sharing 

(U//FOUO) The FBI must share and disseminate information as required by law and applicable 
policy. Working through the supervisory chain and other appropriate entities, FBI employees 
must ensure compliance with statutes, including the Privacy Act, treaties, Executive Orders, 
Presidential directives, National Security Council (NSC) directives, Homeland Security Council 
(HSC) directives, Director of National Intelligence directives, Attorney General-approved 
policies, and MOUs or MOAs. 

14.4 (U) Information Related to Criminal Matters 
14.4.1 (U) Coordinating with Prosecutors 

(U//FOUO) In an investigation relating to possible criminal activity in violation of federal law, 
the FBI employee conducting the investigation must maintain periodic written or oral contact 
with the appropriate federal prosecutor, as circumstances warrant and as requested by the 
prosecutor. When, during such an investigation, a matter appears arguably to warrant 
prosecution, the FBI employee must present the relevant facts to the appropriate federal 
prosecutor. Information on investigations that have been closed must be available on request to a 
United States Attorney (USA) or his or her designee or an appropriate DOJ official. (AGG-Dom, 
Part VI.C) 
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1 4.4.2 (U) Criminal Ma tters Outside FBI Jurisdiction 

(U//FOUO) When credible information is received by an FBI employee concerning serious 
criminal activity not within the FBI’s investigative jurisdiction, the FBI employee must promptly 
transmit the information or refer the complainant to a law enforcement agency having 
jurisdiction, except when disclosure would jeopardize an ongoing investigation, endanger the 
safety of an individual, disclose the identity of a CHS, interfere with the cooperation of a CHS, 
or reveal legally privileged information. If full disclosure is not made for any of the reasons 
indicated, then, whenever feasible, the FBI employee must make at least limited disclosure to a 
law enforcement agency or agencies having jurisdiction, and full disclosure must be made as 
soon as the need for restricting disclosure is no longer present. Where full disclosure is not made 
to the appropriate law enforcement agencies within 180 days, the FBI employee/field office must 
promptly notify FBIHQ in writing of the facts and circumstances concerning the criminal 
activity. The FBI must make periodic reports to the Deputy Attorney General of such non- 
disclosures and incomplete disclosures, in a form suitable to protect the identity of a CHS. 
(AGG-Dom, Part VI.C) 

1 4.4.3 (U) Reporting Criminal Activity of an FBI Employee or CHS 

(U//FOUO) When it appears that an FBI employee has engaged in criminal activity in the course 
of an investigation, the FBI must notify the USAO or an appropriate DOJ division. When it 
appears that a CHS has engaged in criminal activity in the course of an investigation, the FBI 
must proceed as provided in the AGG-CHS . When information concerning possible criminal 
activity by any other person appears in the course of an investigation, the FBI may open an 
investigation of the criminal activity if warranted, and must proceed as provided in Section 14.4.1 
and 14.4.2 above. (AGG-Dom, Part VI.C.3) 

(U//FOUO) The reporting requirements under this paragraph relating to criminal activity by an 
FBI employee or a CHS do not apply to otherwise illegal activity that is authorized in conformity 
with the AGG-Dom or other Attorney General guidelines or to minor traffic offenses. (AGG- 
Dom, Part VI.C.3) 

14.5 (U) Information Related to National Security and Foreign 

Intelligence Matters 

(U//FOUO) All information sharing with a foreign government related to classified national 
security and foreign intelligence must be done in accordance with the FBI Foreign Dissemination 
Manual and effective policies governing MOUs. 

(U//FOUO) The general principle reflected in current law and policy is that there is a 
responsibility to provide information as consistently and fully as possible to agencies with 
relevant responsibilities to protect the United States and its people from terrorism and other 
threats to the national security, except as limited by specific constraints on such sharing. The 
FBI’s responsibility in this area includes carrying out the requirements of the MOU Between the 
Intelligence Community, Federal Law Enforcement Agencies, and the Department of Homeland 
Security Concerning Information Sharing (March 4, 2003), or any successor memorandum of 
understanding or agreement. Specific requirements also exist for internal coordination and 
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consultation with other DOJ components, and for sharing national security and foreign 
intelligence information with White House agencies, as provided below. (AGG-Dom, Part VI.D) 

14 . 5.1 (U) Department of Justice 

(U//FOUO) The DOJ National Security Division (NSD) must have access to all information 
obtained by the FBI through activities relating to threats to the national security or foreign 
intelligence. The Director of the FBI and the Assistant Attorney General for NSD must consult 
concerning these activities whenever requested by either of them, and the FBI must provide such 
reports and information concerning these activities as the Assistant Attorney General for NSD 
may request. In addition to any reports or information the Assistant Attorney General for NSD 
may specially request under this subparagraph, the FBI must provide annual reports to the NSD 
concerning its foreign intelligence collection program, including information concerning the 
scope and nature of foreign intelligence collection activities in each FBI field office. (AGG- 
Dom, Part VI.D. 1) 

(U//FOUO) The FBI must keep the NSD apprised of all information obtained through activities 
under the AGG-Dom that is necessary to the ability of the United States to investigate or protect 
against threats to the national security; this should be accomplished with regular consultations 
between the FBI and the NSD to exchange advice and information relevant to addressing such 
threats through criminal prosecution or other means. (AGG-Dom, Part VI.D.l) 

(U//FOUO) Except for counterintelligence investigations, a relevant USAO must have access to 
and must receive information from the FBI relating to threats to the national security, and may 
engage in consultations with the FBI relating to such threats, to the same extent as the NSD. The 
relevant USAO must receive such access and information from the FBI field offices. (AGG- 
Dom, Part VI.D.l) 

(U//FOUO) In a counterintelligence investigation - i.e., an investigation of espionage or other 
intelligence activities, sabotage, or assassination, conducted by, for, or on behalf of foreign 
powers, organizations, or persons [AGG-Dom, Part VII.S.2]- the FBI may only provide 
information to and consult with a relevant USAO if authorized to do so by the NSD. Until the 
policies required by AGG-Dom, Part VI.D.l.d are promulgated, the FBI may consult freely with 
the USAO concerning investigations within the scope of this subparagraph during an emergency, 
so long as the NSD is notified of such consultation as soon as practicable after the consultation. 
(AGG-Dom, Part VI.D.l). 

(U//FOUO) Information shared with a USAO pursuant to DIOG Section 14.5 (National Security) 
must be disclosed only to the USA or any AUSA designated by the USA as points of contact to 
receive such information. The USA and designated AUSA must have an appropriate security 
clearance and must receive training in the handling of classified information and information 
derived from FISA, including training concerning the secure handling and storage of such 
information and training concerning requirements and limitations relating to the use, retention, 
and dissemination of such information. (AGG-Dom, Part VI.D.l) 

(U//FOUO) The disclosure and sharing of information by the FBI under this paragraph is subject 
to any limitations required in orders issued by the FISC, controls imposed by the originators of 
sensitive material, and restrictions established by the Attorney General or the Deputy Attorney 
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General in particular investigations. The disclosure and sharing of information by the FBI under 
this paragraph that may disclose the identity of a CHS is governed by the relevant provisions of 
the AGG-CHS. (AGG-Dom, Part VI.D.l) 

14.5.2 (U) The White House 

(U//FOUO) In order to carry out their responsibilities, the President, the Vice President, the 
Assistant to the President for National Security Affairs, the Assistant to the President for 
Homeland Security Affairs, the NSC and its staff, the HSC and its staff, and other White House 
officials and offices require information from all federal agencies, including foreign intelligence, 
and information relating to international terrorism and other threats to the national security. 
Accordingly, the FBI may disseminate to the White House foreign intelligence and national 
security information obtained through activities under the AGG-Dom, subject to the following 
standards and procedures. 

14.5.2.1 (U) Requests sent through NSC or HSC 

(U//FOUO) The White House must request such information through the NSC staff or HSC 
staff including, but not limited to, the NSC Legal and Intelligence Directorates and Office of 
Combating Terrorism, or through the President’s Intelligence Advisory Board or the Counsel 
to the President. (AGG-Dom, Part VI.D.2.a) 

(U//FOUO) If the White House sends a request for such information to the FBI without first 
sending the request through the entities described above, the request must be returned to the 
White House for resubmission. 

14.5.2 .2 (U) Approval by the Attorney General 

(U//FOUO) Compromising information concerning domestic officials or domestic political 
organizations, or information concerning activities of USPERs intended to affect the political 
process in the United States, may be disseminated to the White House only with the approval 
of the Attorney General, based on a determination that such dissemination is needed for 
foreign intelligence purposes, for the purpose of protecting against international terrorism or 
other threats to the national security, or for the conduct of foreign affairs. Such approval is not 
required, however, for dissemination to the White House of information concerning efforts of 
foreign intelligence services to penetrate the White House or concerning contacts by White 
House personnel with foreign intelligence service personnel. (AGG-Dom, Part VI.D.2.b) 

14.5.2.3 (U) Information Suitable for Dissemination 

(U//FOUO) Examples of the type of information that is suitable for dissemination to the 
White House on a routine basis includes, but is not limited to (AGG-Dom, Part VI.D.2.c): 

A) (U//FOUO) Information concerning international terrorism; 

B) (U//FOUO) Information concerning activities of foreign intelligence services in the United 
States; 

C) (U//FOUO) Information indicative of imminent hostilities involving any foreign power; 

D) (U//FOUO) Information concerning potential cyber threats to the United States or its allies; 
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E) (U//FOUO) Information indicative of policy positions adopted by foreign officials, 
governments, or powers, or their reactions to United States foreign policy initiatives; 

F) (U//FOUO) Information relating to possible changes in leadership positions of foreign 
governments, parties, factions, or powers; 

G) (U//FOUO) Information concerning foreign economic or foreign political matters that might 
have national security ramifications; and 

H) (U//FOUO) Information set forth in regularly published national intelligence requirements. 

14.5.2.4 (U) Notification of Communications 

(U//FOUO) Communications by the FBI to the White House that relate to a national security 
matter and concern a litigation issue for a specific pending investigation must be made known 
to the Office of the Attorney General, the Office of the Deputy Attorney General, or the 
Office of the Associate Attorney General. White House policy may limit or prescribe the 
White House personnel who may request information concerning such issues from the FBI. 
(AGG-Dom Part VI.D.2.d) 

14.5.2.5 (U) Dissemination of Information relating to Background Investigations 

(U//FOUO) The limitations on dissemination of information by the FBI to the White House 
under the AGG-Dom do not apply to dissemination to the White House of information 
acquired in the course of an FBI investigation requested by the White House into the 
background of a potential employee or appointee, or responses to requests from the White 
House under E.O. 10450 relating to security requirements for government employment. 
(AGG-Dom, Part VI.D.2.e) 

14.5.3 (U) Congress 

(U//FOUO) FBI employees must work through supervisors and the FBI OCA to keep the 
congressional intelligence committees fully and currently informed of the FBI’s intelligence 
activities as required by the National Security Act of 1947, as amended. Advice on what 
activities fall within the supra of required congressional notification can be obtained from OCA 
[A Corporate Policy Directive is forthcoming]. 

14.6 (U) Special Statutory Requirements 

(U) Information acquired under the FISA may be subject to minimization procedures and other 
requirements specified in that Act. (AGG-Dom, Part VI.D.3.a) 

(U) Information obtained through the use of National Security Letters (NSLs) under 15 U.S.C. § 
168 lv (full credit reports) may be disseminated in conformity with the general standards of 
AGG-Dom, Part VI, and DIOG Section 18.6.6.6.1.8. Information obtained through the use of 
NSLs under other statutes may be disseminated in conformity with the general standards of the 
AGG-Dom, Part VI, subject to any specific limitations in the governing statutory provisions (see 
DIOG Section 18): 12 U.S.C. § 3414(a)(5)(B); 15 U.S.C. § 1681u(f); 18 U.S.C. § 2709(d); 50 
U.S.C. § 436(e). (AGG-Dom, Part VI.D.3.b) 
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(U) Federal Rule of Criminal Procedure 6(e) generally prohibits disclosing "matters occurring 
before the grand jury." This includes documents, records, testimony of witnesses, or any other 
evidence deemed relevant by a sitting grand jury. The Attorney General has issued revised 
Guidelines for the Disclosure and Use of Grand Jury Information under Rule 6(e~)C3')(DL On May 
15, 2008, the Deputy Attorney General issued a memorandum which provides amplifying 
guidance as to lawful use arid disclosure of 6(e) information. See also AGG-Dom, Part V.A.8 
and DIOG Section 18.6.5.3.7.4.5. 

14.7 (U) Threat To Life - Dissemination Of Information 

14.7.1 (U) Overview 

(U//FOUO) The FBI has a responsibility to notify persons of threats to their life or threats that 
may result in serious bodily injury and to notify other law enforcement agencies of such threats 
(Extracted from DOJ Office of Investigative Policies. Resolution 20. dated 12/16/96') . Depending 
on the exigency of the situation, an employee, through his or her supervisor, must notify the 
appropriate operational division at FBIHQ of the existence of the threat and the plan for 
notification. That plan may be followed unless advised to the contrary by FBIHQ. 

14. 7.2 (U//FOUO) Information Received through FISA Surveillance 

(U//FOUO) If information is received through a FISA-authorized investigative technique 
indicating a threat to life or serious bodily harm within the scope of Section 14.7, the field office 
case agent responsible for that FISA must immediately coordinate the matter with the FBIHQ 
SSA responsible for that investigation and an NSLB attorney from the applicable 
counterintelligence or counterterrorism law unit. These individuals must consult the applicable 
FISA minimization procedures, consider the operational posture of the investigation, and 
collectively determine the appropriate manner in which to proceed. FBI executive management 
may be consulted, as appropriate (e.g., if DIDO or declassification authority is needed). The field 
office case agent must document the dissemination. If the decision is made not to disseminate the 
threat information, that decision must be approved by an ASAC or higher and the reasons must 
be documented in the applicable investigative file. 

14.7.3 (U) DlSSEMINA TION OF INFORMA TION CONCERNING THREA TS AGAINST 
Intended Victims (Persons) 

14.7.3.1 (U) Warning to the Intended Victim (Person) 

14.7.3.1.1 (U) Expeditious Warnings to Identifiable Intended Victims 

(U//FOUO) Except as provided below in Sections 14.7.3.1.1.1 (Exceptions) and 14.7.3.1.2 
(Custody or Protectee), when an employee has information that a person who is identified or 
can be identified through reasonable means (hereafter a “intended victim”) is subject to a 
credible threat to his/her life or of serious bodily injury, the FBI employee must attempt 
expeditiously to warn the intended victim of the nature and extent of the threat. 
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14.7.3.1.1.1 (U) Exceptions to Warning 

(U//FOUO) An employee is not required to warn an intended victim if : 

A NU//FOUQ1 | | 

B) (U//FOUO) the intended victim knows the nature and extent of the specific threat against 
him/her. 

14.7.3.1.1.2 (U) Means, Manner, and Documentation of 
Warning/Notification or Decision Not to Warn 

(U//FOUO) The FBI employee, in consultation with his or her supervisor, must determine the 
means and manner of the warning, using the method most likely to provide direct notice to the 
intended victim. In some cases, this may require the assistance of a third party. The employee 
must document on an FD-999 the content of the warning, as well as when, where and by 
whom it was delivered to the intended victim. The FD-999 must be placed in a zero file or if 
investigative methods are used, the appropriate investigative file. 

(U//FOUO) The employee, in consultation with his or her supervisor, may seek the assistance 
of another law enforcement agency to provide the warning. If this is done, the employee must 
document on an FD-999 that notice was provided by that law enforcement agency, as well as 
when, where and by whom (i.e., the name of the other agency's representative) it was 
delivered. The employee must also document the other agency's agreement to provide a 
timely warning. The FD-999 must be filed as specified above. 

(U//FOUO) Whenever time and circumstances permit, an employee's decision not to provide 
a warning in these circumstances must be approved by an ASAC or higher. In all cases, the 
reasons for not providing a warning must be documented by EC or similar successor form in a 
zero file or if investigative methods are used, the appropriate investigative file. 

14.7.3.1.2 (U) Warnings When Intended Victim is in Custody or is a Protectee 

(U//FOUO) When an employee has information that a person described below is an intended 
victim, the employee, in consultation with his or her supervisor, must expeditiously notify the 
law enforcement agency that has protective or custodial jurisdiction of the threatened person. 

(U//FOUO) This section applies when the intended victim is: 

A) (U//FOUO) a public official who, because of his/her official position, is provided a protective 
detail; 

B ) ft J//FOI JOl I 


C) (U//FOUO) detained or incarcerated. 
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(U//FOUO) This paragraph does not apply to employees serving on the security detail of the 
FBI Director or any other FBI protected persons when the threat is to the individual they 
protect. 

14.7.3.1.2.1 (U) Means, Manner, and Documentation of 
Warning/Notification 

(U//FOUO) The employee, in consultation with his or her supervisor, may determine the 
means and manner of the notification. When providing notification, the employee shall 
provide as much information as possible regarding the threat and the credibility of the threat. 
The employee must document on an FD-999 what he or she informed the other law 
enforcement agency, and when, where, how (e.g., telephone call, email) and to whom the 
notice was delivered. The FD-999 must be placed in a zero file or if investigative methods are 
used, the appropriate investigative file. 

14.7.3.2 (U) Notification to Law Enforcement Agencies That Have Investigative 
Jurisdiction 

14. 7.3.2.1 (U) Expeditious Notification 

14.7.3 .2.1.1 (U) Threats to Intended Persons 

(U//FOUO) Except as provided in Sections 14.7.3.2.2, when an employee has information that 
a person (other than a person described above in Section 14.7.3.1.2) who is identified or can 
be identified through reasonable means is subject to a credible threat to his/her life or of 
serious bodily injury, the employee must attempt expeditiously to notify other law 
enforcement agencies that have investigative jurisdiction concerning the threat. 

14.7.3 .2.1.2 (U) Threats to Occupied Structures or Conveyances 

(U//FOUO) When an employee has information that a structure or conveyance which can be 
identified through reasonable means is the subject of a credible threat which could cause a 
loss of life or serious bodily injury to its occupants, the employee, in consultation with his or 
her supervisor, must provide expeditious notification to other law enforcement agencies that 
have jurisdiction concerning the threat. 

1 4. 73.2.2 (U) Exceptions to Notifica tion 

(U//FOUO) An employee need not attempt to notify another law enforcement agency that has 
investigative jurisdiction concerning a threat: 

A ) (U//FOUO)! 

B) (U//FOUO) when the other law enforcement agency knows the nature and extent of the 
specific threat to the intended victim. 

(U//FOUO) Whenever time and circumstances permit, an employee's decision not to provide 
notification to another law enforcement agency in the foregoing circumstances must be 
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approved by an ASAC or higher. In all cases, the reasons for an employee's decision not to 
provide notification must be documented in writing in a zero file or if investigative methods 
are used, the appropriate investigative file. 

14 . 7 . 3 . 2.3 Means, Manner, and Documentation of Notification 

(U//FOUO) The employee may determine the means and manner of the notification. The 
employee must document in writing in the applicable investigative file the content of the 
notification, and when, where, and to whom it was delivered. 

14. 7.4 (U//FOUO) Dissemination of Information Concerning Threats, 

Possible Violence or Demonstrations Against Foreign 
Establishments or Officials in the United St a tes 

(U//FOUO) If information is received indicating a threat to life within the scope of Section 14.7, 
or possible violence or demonstrations against foreign establishments or officials in the United 
States, the field office case agent must immediately coordinate the matter with the FBIHQ SSA 
responsible for the case, who must notify the Department of State (DOS), United States Secret 
Service (USSS), and any other Government agencies that may have an interest. See Section IV 
of the 1973 FBI USSS MOU, which is available at 

| b7E 

| for the FBI’s information sharing responsibilities with the USSS 

in such cases. 

14. 7.5 (U) Dissemination of Information Concerning Threats against the 
President and Other Designated Officials 

(U//FOUO) The United States Secret Service (USSS) has statutory authority to protect or to 
engage in certain activities to protect the President and certain other persons as specified in 18 
U.S.C. § 3056. An MOU between the FBI and USSS specifies the FBI information that the 
USSS wants to receive in connection with its protective responsibilities. 

(U//FOUO) Detailed guidelines regarding threats against the President of the United States and 
other USSS protectees can be found in "Presidential and Presidential Staff Assassination, 

Kidnapping and Assault.” (See the Violent Crimes PG1 
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15 (U) INTELLIGENCE ANALYSIS AND PLANNING 


§15 


15.1 (U) Overview 

(U//FOUO) The Attorney General’s Guidelines for Domestic FBI Operations (AGG-Dom) 
provide specific guidance and authorization for intelligence analysis and planning. This authority 
enables the FBI to identify and understand trends, causes, and potential indicia of criminal 
activity and other threats to the United States that would not be apparent from the investigation 
of discrete matters alone. By means of intelligence analysis and planning, the FBI can more 
effectively discover criminal threats, threats to the national security, and other matters of national 
intelligence interest, and can provide the critical support needed for the effective discharge of its 
investigative responsibilities and other authorized activities. (AGG-Dom, Part IV) 

(U//FOUO) In carrying out its intelligence analysis and planning functions, the FBI is authorized 
to draw on all lawful sources of information, including analysis of historical information in FBI 
files (open and closed), records and database systems, and information collected from 
investigative activities permitted without opening an Assessment set forth in DIOG Section 
5.1.1. 

(U//FOUO) Note : In the DIOG, the word “assessment” has two distinct meanings. The AGG- 
Dom authorizes as an investigative activity an “Assessment,” which requires an authorized 
purpose as discussed in DIOG Section 5 . The United States Intelligence Community (USIC), 
however, also uses the word “assessment” to describe written intelligence products, as discussed 
in Section 15.6.1.2 below . 

15.2 (U) Purpose and Scope 

15.2.1 (U) Functions Authorized 

(U//FOUO) The AGG-Dom authorizes the FBI to engage in intelligence analysis and planning to 
facilitate and support investigative activities and other authorized activities. The functions 
authorized include: 

A) (U//FOUO) Development of overviews and analyses concerning threats to and vulnerabilities 
of the United States and its interests, such as domain management as related to the FBI’s 
responsibilities; 

B) (U//FOUO) Research and analysis to produce reports and assessments (analytical products) 
concerning matters derived from or relevant to investigative activities or other authorized FBI 
activities; and 

C) (U//FOUO) The operation of intelligence and information systems that facilitate and support 
investigations and analysis through the compilation and analysis of data and information on an 
ongoing basis. (AGG-Dom, Introduction B) 
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15.2.2 (U) Integration of Intelligence Activities 

(U//FOUO) In order to protect against national security and criminal threats through intelligence- 
driven operations, the FBI should integrate intelligence activities into all investigative efforts by: 

A) (U//FOUO) Systematically assessing particular geographic areas or sectors to identify 
potential threats, vulnerabilities, gaps, and collection opportunities in response to FBI 
collection requirements that support the broad range of FBI responsibilities; 

B) (U//FOUO) Proactively directing resources to collect against potential threats and other 
matters of interest to the nation and the FBI, and developing new collection capabilities when 
needed; 

C) (U//FOUO) Continuously validating collection capabilities to ensure information integrity; 

D) (U//FOUO) Deliberately gathering information in response to articulated priority intelligence 
requirements using all available collection resources, then expeditiously preparing the 
collected information for analysis and dissemination and promptly disseminating it to 
appropriate partners at the local, state, national and foreign level; and 

E) (U//FOUO) Purposefully evaluating the implications of collected information on current and 
emerging threat issues. 

1 5.2.3 (U) Analysis and Planning Not Requiring the Opening of an 
Assessment (See DIOG Section 5) 

(U//FOUO) Without opening an Assessment, an FBI employee may produce written intelligence 
products that include, but are not limited to, an Intelligence Assessment (analytical product). 
Intelligence Bulletin and Geospatial Intelligence (mapping) from information already within FBI 
records. An FBI employee can also analyze information that is obtained pursuant to DIOG 
Section 5.1.1. If the employee needs information in order to conduct desired analysis and 
planning that requires the use of Assessment investigative methods beyond those permitted in 
DIOG Section 5.1.1, the employee must open a Type 4 Assessment in accordance with DIOG 
Sections 5.6.3.3. The applicable 801H - 807H classification file (or other 801-series 
classification file as directed in the Intelligence Policy Implementation Guide (IPG)) must be 
used to document this analysis. See the IPG for file classification guidance. 

15.3 (U) Civil Liberties and Privacy 

(U) The FBI must collect intelligence critical to the FBI’s ability to carry out its intelligence and 
law enforcement mission. While conducting intelligence analysis and planning, the FBI will 
conduct its activities in compliance with the Constitution, federal laws, the AGG-Dom and other 
relevant authorities in order to protect civil liberties and privacy. 

1 5 .4 (U) Legal Authority 

(U) The FBI is an intelligence agency as well as a law enforcement agency. Accordingly, its 
basic functions extend beyond limited investigations of discrete matters, and include broader 
analytic and planning functions. The FBI’s responsibilities in this area derive from various 
administrative and statutory sources. See, e.g., (i) 28 U.S.C. §§ 532 note (incorporating P.L. 108- 
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458 §§ 2001-2003) and 534 note (incorporating P.L. 109-162 § 1 107); and (ii) E.0. 12333 § 
1.7(g). 

(U//FOUO) The scope of authorized activities under Part II of the AGG-Dom is not limited to 
“investigations” in a narrow sense, such as solving particular investigations or obtaining 
evidence for use in particular criminal prosecutions. Rather, the investigative activities 
authorized under the AGG-Dom may be properly used to provide critical information needed for 
broader analytic and intelligence purposes to facilitate the solution and prevention of crime, 
protect the national security, and further foreign intelligence objectives. These purposes include 
use of the information in intelligence analysis and planning under AGG-Dom, Part IV, and 
dissemination of the information to other law enforcement, USIC, and White House agencies 
under AGG-Dom, Part VI. Accordingly, information obtained at all stages of investigative 
activity is to be retained and disseminated for these purposes as provided in the AGG-Dom, or in 
FBI policy consistent with the AGG-Dom, regardless of whether it furthers investigative 
objectives in a narrower or more immediate sense. (AGG-Dom, Part II) 

15.5 (U) Intelligence Analysis and Planning - Requiring a Type 4 Assessment 

(U//FOUO) If an FBI employee wishes to engage in intelligence analysis and planning that 
requires the collection or examination of information not available in existing FBI records or 
database systems, or from information that cannot be obtained using the activities authorized in 
DIOG Section 5.1.1, a Type 4 Assessment must be opened and conducted in accordance with 
DIOG Section 5.6.3.3. 

15.6 (U) Authorized Activities in Intelligence Analysis and Planning 

(U) The FBI may engage in intelligence analysis and planning to facilitate or support 
investigative activities authorized by the AGG-Dom or other legally authorized activities. 
Activities the FBI may carry out as part of Intelligence Analysis and Planning include: 

15.6.1 (U) Strategic Intelligence Analysis 

(U//FOUO) The FBI is authorized to develop overviews and analyses of threats to and 
vulnerabilities of the United States and its interests in areas related to the FBI’s responsibilities, 
including domestic and international criminal threats and activities; domestic and international 
activities, circumstances, and developments affecting the national security. FBI overviews and 
analyses may encompass present, emergent, and potential threats and vulnerabilities, their 
contexts and causes, and identification and analysis of means of responding to them. (AGG- 
Dom, Part IV) 


15.6.1.1 (U) Domain Management 

(U//FOUO) As part of Strategic Analysis Planning activities, the FBI may collect information 
in order to improve or facilitate “domain awareness” and may engage in “domain 
management.” “Domain management” is the systematic process by which the FBI develops 
cross-programmatic domain awareness and leverages its knowledge to enhance its ability to: 
(i) proactively identify threats, vulnerabilities, and intelligence gaps; (ii) discover new 
opportunities for needed intelligence collection and prosecution; and (iii) set tripwires to 
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provide advance warning of national security and criminal threats. Tripwires are described in 
DIOG Section 11. Effective domain management enables the FBI to identify significant 
threats, detect vulnerabilities within its local and national domain, identify new sources and 
threat indicators, and recognize new trends so that resources can be appropriately allocated at 
the local level in accordance with national priorities and local threats. 


(U//FOUO) The field office “domain” is the territory for which a field office exercises 
responsibility, also known as the field office’s area-of-responsibility (AOR). Domain 
awareness is the: (i) strategic understanding of national security and criminal threats and 
vulnerabilities that exist in the domain; (ii) FBI’s positioning to collect against those threats 
and vulnerabilities; and (iii) the ability to recognize intelligence gaps related to the domain. 


(U//FOUO) Through analysis of previously collected information, supplemented as necessary 
by properly authorized T ype 4 Assessments, domain management should be undertaken at the 


local and national levels.l 

1 




pee DIOG Section 1 1 for further discussion of 


tripwires. Further guidance regardin g domain management and examples of in telligence 
products are contained in the FBIHQl I 


(U//FOUO) Al l information collected during a Type 4 Domain Assessment must be 

documented ini I 

las rli reefed in thel 


investigation must oe opened 


lor Predicated 


(U//FOUO) FBIHQ DI provides specific guidance in its PG regarding, the opening, 
coordination and purpose for a field office and national domain Type 4 Assessments. 


15.6.1.2 (U) Written Intelligence Products 

(U//FOUO) The FBI is authorized to conduct research, analyze information, and prepare 
reports and intelligence assessments (analytical written products) concerning matters relevant 
to authorized FBI activities, such as: (i) reports and intelligence assessments (analytical 
product) concerning types of criminals or criminal activities; (ii) organized crime groups, 
terrorism, espionage, or other threats to the national security; (iii) foreign intelligence matters; 
or (iv) the scope and nature of criminal activity in particular geographic areas or sectors of the 
economy. (AGG-Dom, Part IV) 

(U//FOUO) Pursuant to Rule 16 of the Federal Rules of Criminal Procedure, 18 U.S.C. 
Section 3500, and Department of Justice (DOJ) policy, written intelligence products, 
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including classified intelligence products, may be subject to discovery in a criminal 
prosecution, if they relate to an investigation or are produced from information gathered 
during an investigation. Therefore, a copy of written intelligence products that are directly 
related to an investigation must be filed in the appropriate investigative file(s) and must 
include appropriate classification markings. 

(U//FOUO) A sub-file named “INTELPRODS” exists for all investigative classifications, 
and a copy of all written intelligence products described above must be placed in the 
appropriate investigative classification INTELPRODS sub-file. 

15.6.1.3 (U) United States Person (USPER) Information 

(U//FOUO) Reports, Intelligence Assessments, and other FBI intelligence products should not 
contain USPER information, including the names of United States corporations or business 
entities, if the pertinent intelligence can be conveyed in an understandable way without 
including personally identifying information. 

(U//FOUO) Intelligence products prepared pursuant to this Section include, but are not limited 
to: Domain Management, Special Events Management Threat Assessments, Intelligence 
Assessments, Intelligence Bulletins, Intelligence Information Reports, Weapons of Mass 
Destruction (WMD) Scientific and Technical Assessments, and Regional Field Office 
Assessments. 


15.6.1.4 (U) Intelligence Systems 

(U//FOUO) The FBI is authorized to operate intelligence, identification, tracking, and 
information systems in support of authorized investigative activities, or for such other or 
additional purposes as may be legally authorized, such as intelligence and tracking systems 
relating to terrorists, gangs, or organized crime groups. (AGG-Dom, Part IV) 



(U//FOUO) When developing a new database, the FBI Office of the General Counsel Privacy 
and Civil Liberties Unit must be consulted to determine whether a Privacy Impact Assessment 
(PIA) must be prepared. 
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15.6.1.5 (U) Geospatial Intelligence (GEOINT) 

(U//FOUO) Geospatial Intelligence (GEOINT) is the exploitation and analysis of imagery and 
geospatial information to describe, assess and visually depict physical features and 
geographically-referenced activities on the Earth. As an intelligence discipline, GEOINT in 
the FBI encompasses all the activities involved in the collection, analysis, and exploitation of 
spatial information in order to gain knowledge about the national security/criminal 
environment and the visual depiction of that knowledge. GEOINT also represents a type of 
information or intelligence product, namely the information and knowledge that is produced 
as a result of the discipline’s activities. 
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16 (U) UNDISCLOSED PARTICIPATION (UDP) 


16.1 (U) Overview 

(U//FOUO) Undisclosed participation (UDP) takes place when anyone acting on behalf of the 
FBI, including but not limited to an FBI employee or confidential human source (CHS), becomes 
a member or participates in the activity of an organization on behalf of the U.S. Government 
(USG) without disclosing FBI affiliation to an appropriate official of the organization. 

16.1.1 (U) Authorities 

(U) The FBI derives its authority to engage in UDP in organizations as part of its investigative 
and intelligence collection missions from two primary sources. 

(U) First, Executive Order (E.O.) 12333 broadly establishes policy for the United States 
Intelligence Community (USIC). Executive Order 12333 requires the adoption of procedures for 
undisclosed participation in organizations on behalf of elements of the USIC within the United 
States. Specifically, the Order provides “. . . [n]o one acting on behalf of the Intelligence 
Community may join or otherwise participate in any organization in the United States on behalf 
of the any element of the Intelligence Community without first disclosing such person’s 
intelligence affiliation to appropriate officials of the organization, except in accordance with 
procedures established by the head of the Intelligence Community element concerned .... Such 
participation shall be authorized only if it is essential to achieving lawful purposes as determined 
by the Intelligence Community element head or designee.” (E.O. 12333, Section 2.9, 

Undisclosed Participation in Organizations within the United States). The Order also provides, at 
Section 2.2, that “[njothing in [E.O. 12333] shall be construed to apply to or interfere with any 
authorized civil or criminal law enforcement responsibility of any department or agency.” 

(U) Second, in addition to its role as member of the USIC, the FBI is also the primary criminal 
investigative agency of the federal government with authority and responsibility to investigate all 
violations of federal law that are not exclusively assigned to another federal agency. This 
includes the investigation of crimes involving international terrorism and espionage. As a 
criminal investigative agency, the FBI has the authority to engage in UDP as part of a Predicated 
Investigation or an Assessment. 

(U//FOUO) The FBI’s UDP policy is designed to incorporate the FBI’s responsibilities as both a 
member of the USIC and as the primary criminal investigative agency of the federal government 
and, therefore, applies to all investigative and information collection activities of the FBI. It is 
intended to provide uniformity and clarity so that FBI employees have one set of standards to 
govern all UDP. As is the case throughout the DIOG, however, somewhat different constraints 
exist if the purpose of the activity is the collection of positive foreign intelligence that falls 
outside the FBI’s law enforcement authority. Those constraints are reflected where applicable 
below. 
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1 6.2.2 (U) Legitimate Organization 

(U//FOUQ1I I 


1 6.2.3 (U) Participation 

(U//FOUOI 


(U//FOUO) ! H UPP may involve the following: 

A) (U//FOUO; 
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D ) (U//FOUOJ 




(U//FOUO] 

1 



(U//FOUO) Examples of 


A) (U//FOUOi 

1 

[ 

1 

ttJ//FOUOl 

1 



B) (U//FOUO)! | 



(U//FOUO) | 

1 



c: 

(u//Fouq 1 



D) (U//FOUOI 1 




16.2.3.1 (U) Undisclosed Participation 



16.2.3.2 (U//FOUO) Influencing the Activities of the Organization 

(UT/HXJOJ 
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16.2.3.3 (U//FOUO) Influencing the exercise of First Amendment rights 



16.2.3.5 fu ll Undisclosed Participation 

(U//FOUO) Undisclosed participation in the activity of: 



16.2.3.6 (U) Already a Member of the Organization or a Participant in its 


Activities 
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16.3 (U) Requirements for Approval 


1 6.3.1 (U) General Requirements 



16.3.1.2 (U) Concurrent Approval 

(U//F0U01 



16.3.1.3 (U) Delegation and "Acting" Status 

(U//FOUQ1 


(U//POUO n I 
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16.3.1.4 (U) Specific Requirements for General Undisclosed Participation (Non- 

sensitive UDP) 

16.3.1.4.1 ( U//FOUO j 
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C UU//FOUCfll 1 


16.4 | 

(U//FOU< 

[U) Supervisory Approval Not Required 



i i 

A' 

[ 

) (U//FOUO)| 1 


b; 

1 (U//F0U01 1 

Cj 


l (U//FOUO)! 


D) (U//FOUO 



E) (U//FOUO; | 



16.5 | 

(U//FOU( 

[U) Standards for Review and Approval 

2U , 

i : 

A) (U//FOUO)) 

B) (U//FOUO) 
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B) (U//FOUQ1 | 


C) (U//FOUO) 


D) (U//FOUO) I 



(U//FOUQ1 


16.8 (U//FOUO) Sensitive Operations Review Committee (SORC) 

16.8.1 (U//FOUO) SORC Notification 

(U//FOUO) As indicated above, the field office will provide notification to the SORC, through 
the AD of the FBI Headquarters division with oversight responsibility for the investigation or 
Assessment concerning the following approved UDP: 

A) (U//FOUO)| 
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(U//FOUO) Such notifications will be received by the FBI staff supporting the SORC. The 
SORC will receive reports of such UDP from the supporting staff on a schedule and in a form to 
be determined by the SORC. 

1 6.8.2 (U//FOUO) SORC Review 

(U//FOUO) The SORC will review any proposed sensitive UDP in an organization 


(U//FOUO) For more details regarding the organization and functions of the SORC, see DIOG 
Section 10.2 above and Section 16.9 below. 

16.9 (U) FBIHQ Approval Process of UDP Requests 

16.9.1 (U) Submitting the UDP request to FBIHQ 

(U//FOUO)! 


(U//FOUO)! 
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(U//F0U01 





16.10 (U) UDP Examples 




A) (U//F0U01 
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K) (U//FOU(J 
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17 (U) OTHERWISE ILLEGAL ACTIVITY (OIA) 


§17 


17.1 (U) Overview 

(U//FOUO) Otherwise Illegal Activity (OIA) is conduct in the course of duties by an FBI 
employee (to include an undercover employee (UCE)) or a confidential human source (CHS) 
which constitutes a crime under local, state, or federal law if engaged in by a person acting 
without authorization. OIA can be authorized for an FBI employee or CHS to obtain information 
or evidence necessary for the success of an investigation under the following limited 

circumstances: (i) when tha t information or evidence is not reasonably available without 

participation in the OIA; (ii)| 

|or (in) when necessary to prevent serious bodily injury 
or death. Certain types of OIA cannot be authorized, such as participation in conduct that would 
constitute an unlawful investigative technique (e.g., an illegal wiretap) or participation in an act 
of violence. In this context, "participation in an act of violence" does not include acts taken in 
self-defense and defense of others by the FBI employee or CHS because such actions would not 
be illegal. 

17.2 (U) Purpose and Scope 

(U//FOUO) The use of OIA may be approved in the course of undercover activities or operations 
that involve an FBI employee or that involve use of a CHS. When approved, OIA should be 
limited or minimized in scope to only that which is reasonably necessary under the 
circumstances including the duration and geographic area to which approval applies, if 
appropriate. 

17.3 (U//FOUO) OIA in Undercover Activity 

(U//FOUO) General: The use of the undercover method is discussed in the DIOG Section 
18.6.13. OIA is often proposed as part of an undercover scenario or in making the initial 
undercover contacts before the operation is approved. Specific approval for OIA must be 
obtained in the context of these undercover activities or operations in addition to general 
approval of the scenario or the operation. 

(U//FOUO) OLA by an FBI employee in an undercover operation relating to activity in violation 
of federal criminal law that does not concern a threat to the national security or foreign 
intelligence: must be approved in conformity with The Attorney General’s Guidelines on FBI 
Undercover Operations ( AGG-UCO) . Approval of OLA in conformity with the AGG-UCO is 
sufficient and satisfies any approval requirement that would otherwise apply under the AGG- 
Dom. Additional discussion is provided in the Field Guide for FBI Undercover and Sensitive 
Operations . A Special Agent in Charge (SAC) may approve the OIA described in subsection 
17.5. 


A) (U//FOUO) When a UCE provides goods and service (reasonably unavailable to the subject 
except as provided by the United States government) that facilitate a felony, or its equivalent 
under federal, state, or local law, it is a sensitive circumstance. In these sensitive 
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circumstances, additional authorization by an Assistant Director is required after review by the 
Criminal Undercover Operations Review Committee (CUORC). 

B) (U//FOUO) Participation in otherwise illegal activity that involves a significant risk of 
violence or physical injury requires authorization by the Director, Deputy Director, or 
designated Executive Assistant Director after review by the CUORC. 

(U//FOUO) OIA by an FBI employee in an undercover operation (UCO) relating to a threat to 
the national security or foreign intelligence collection must conform to the AGG-Dom and the 
FBFs National Security Undercover Operations Policy Implementation Guide (NSUCOPG). The 
Department of Justice (DOJ) National Security Division (NSD) is the approving component for 
OIA that requires approval beyond that authorized for SAC approval described in DIOG 
subsection 17.5, below. However, as authorized by the Assistant Attorney General for NSD, 
officials in other DOJ components may approve OIA in such investigations. 

17.4 (U//FOUO) OIA BY AN FBI Employee AND NON-CONFIDENTIAL PARTY - 

Approval 

(U//FOUO) Unless otherwise indicated, an SAC may authorize the following OIA for an FBI 
employee only when consistent with other requirements of this section, the AGG-Dom, the 
AGG-UCO, and other FBI policy. OIA activities described in subsections B, C, D, and F below, 
require CDC review prior to SAC approval: 

A) (U//FOUO) Otherwise illegal activity that would not be a felony under federal, state, local, or 
tribal law; 

B) (U//FOUO) Consensual monitoring, even if a crime under state, local, or tribal law; 

1) (U//FOUO') Consent of aU parties to the comnunication . 


a) (U//FOUO) The law of the state or territory where the monitoring will take place will 
govern whether OIA approval is needed. 
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d) (U//FOUO) See DIOG 18.6.1.5.1.5 if required to provide notice of consensual 
monitoring to another field office. 

2) (U//FOUO 


3) (U//FOUO) Other approvals for the consensual monitoring may apply such as those 
required when the consensual monitoring involves a sensitive monitoring circumstance. 

See DIOG Section 18.6.1.6.3. 

C) (U//FOUO) The controlled purchase, receipt, delivery, or sale of drugs, stolen property, or 
other contraband; 

D) (U//FOUO) The payment of bribes; 

E) (U//FOUO) Note: the payment of bribes and the amount of such bribes in a public corruption 
matter may be limited by other FBI policy (see the Public Corruption PG and Confidential 
Funding PG); 

F) (U//FOUO) The making of false representations in concealment of personal identity or the true 
ownership of a proprietary; and 

G) (U//FOUO) Conducting a money laundering transaction or transactions involving an aggregate 
amount not exceeding $1 million. 

(U//FOUO) The field office should notify the appropriate FBIHQ operational division and OGC 
of any OIA proposed activity that in the judgment of the approving official may expose 
employees or others to significant personal safety risks, create a risk of civil liability, result in 
adverse publicity, or raise any other sensitive operational concern. As a matter of FBI policy, 
“judgment” means that the decision of the authorizing official is discretionary. (U//FOUO) An 
SAC may not authorize a violation of export control laws or laws that concern the proliferation 
of weapons of mass destruction during an investigation relating to a threat to the national 
security or foreign intelligence collection. 

17.5 (U//FOUO) OIA by a Confidential Human Source (CHS) - Approval 

(U//FOUO) OIA by a CHS must be approved in conformity with the AGG-CHS and the FBI 
CHSPG. In additionl ~1 


A) (U//FOUO) The law of the state or territory where the monitoring will take place will gov ern 
whether OIA approval is needed] 
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C) (U//FOUO) Other approvals for the consensual monitoring may apply such as those required 
when the consensual monitoring involves a sensitive monitoring circumstance. See DIOG 
Section 18.6.1.6.3. 


D) (U//FOUO) See DIOG 1 8.6. 1 .5. 1 .5 if required to provide notice of consensual monitoring to 
another field office. 


17.6 (U//FOUO) OIA Re lated T( | 

I (investigations 


(U//FOUO) In accordance with Part V.C.3 of the AGG-Dom, the Director of the FBI and the 
Assistant Attorney General for the NSD of the DOJ established the following policy for FBI 



B) (U//FOUO) NSD has represented that, except in exceptional circumstances, NSD shall act 
upon such an oral request within 24 hours and shall, within 72 hours, provide the FBI 
documentation of the authorization, including any terms and conditions. 
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D ) (U//FOUO) Except in exceptional circum stances, any request for approval of OIA tha fl | 

| | other than those described in paragraph A, must be 

made in writing to NSC). 

(U//FOUO) Any questions about this policy or its implementation should be directed to OGC, 
National Security Law Branch, Counterterrorism Law Units. 

17.7 (U//FOUO) Standards for Review and Approval of OIA 

(U//FOUO) No official may recommend or approve participation by an FBI employee in OIA 
unless the participation is justified: 

A) (U//FOUO) To obtain information or evidence necessary for the success of the investigation 
and not reasonably available without participation in the otherwise illegal activity; 

B) (U//FOUO ] | or 

C) (U//FOUO) To prevent death or serious bodily injury. 

17.8 (U) OIA NOT AUTHORIZED 

(U//FOUO) The following activities may not be authorized as OIA: 

A) (U//FOUO) Directing or participating in acts of violence; 

(U//FOUO) Note : Self-defense and defense of others. FBI employees are authorized to engage 
in any lawful use of force, including the use of force in self-defense or defense of others in the 
lawful discharge of their duties. 

B) (U//FOUO) Activities or investigative methods that cannot be authorized because they 

are prohibited by law, including activities that would violate protected constitutional or federal 
statutory rights in the absence of a court order or warrant such as illegal wiretaps and searches. 
For example, approving a non-consensual, non-emergency wiretap without a court order; 
approving the search of a home without a warrant or an exception to the warrant requirement, 
etc. 

17.9 (U) Emergency Situations 

(U//FOUO) Without prior approval, an FBI employee may engage in OIA that could be 
authorized under this section only if necessary to meet an immediate threat to the safety of 
persons or property or to the national security, or to prevent the compromise of an investigation 
or the loss of a significant investigative opportunity. In such a situation, prior to engaging in the 
OIA, every effort should be made by the FBI employee to consult with the SAC, and by the SAC 
to consult with the United States Attorney’s Office (USAO) or appropriate DOJ Division where 
the authorization of that office or division would be required unless the circumstances preclude 
such consultation. Circumstances in which OIA occur pursuant to this paragraph without the 
authorization required must be reported as soon as possible to the SAC, and by the SAC to 
FBIHQ and to the USAO or appropriate DOJ Division. 
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18 (U) INVESTIGATIVE METHODS 

18.1 (U) Overview 

18.1.1 (U) Investigative Methods Listed by Sub-Section Number 

(U) The following investigative methods are listed by DIOG Sub-Section number: 

18.5.1 (U) Public information. 

18.5.2 (U) Records or information - FBI and DOJ. 

18.5.3 (U) Records or information - Other federal, state, local, tribal, or foreign government 
agency. 

18.5.4 (LO On-line services and resources. 

18.5.5 (U) CHS use and recruitment. 

18.5.6 (LO Interview or request information from the public or private entities. 

18.5.7 (U) Information voluntarily provided by governmental or private entities. 

18.5.8 (LD Physical Surveillance (not requiring a court order). 

18.5.9 (U) Grand jury subpoenas - for telephone or electronic mail subscriber information only. 

18.6.1 (U) Consensual monitoring of communications, including electronic communications. 

18.6.2 (TJ) Intercepting the communications of a computer trespasser. 

18.6.3 (U) Closed-circuit television/video surveillance, direction finders, and other monitoring 
devices. 

18.6.4 (U) Administrative subpoenas. 

18.6.5 (U) Grand jury subpoenas. 

18.6.6 (U) National Security Letters. 

18.6.7 (U) FISA Order for business records. 

18.6.8 (U) Stored wire and electronic communications and transactional records. 

18.6.9 (U) Pen registers and trap/trace devices. 

18.6.10 (U) Mail covers. 

18.6.1 1 (U) Polygraph examinations. 

18.6.12 (U) Trash Covers (Searches that do not require a warrant or court order). 
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18.6.13 (U) Undercover operations. 

18.7.1 (U) Searches - with a warrant or court order. 

18.7.2 (U) Electronic surveillance — Title III. 

18.7.3 (U) Electronic surveillance - FISA and FISA Title VII (acquisition of foreign intelligence 
information). 

18.1.2 (U) Investigative Methods Listed byName (Alphabetized) 

(U) The following investigative methods are listed alphabetized by DIOG name: 

(U) Administrative subpoenas. (Section 18.6.41 
(U) CHS use and recruitment. (Section 18.5.51 

(U) Closed-circuit television/video surveillance, direction finders, and other monitoring devices. 
(Section 18.6.31 

(U) Consensual monitoring of communications, including electronic communications. (Section 
18.6.11 

(U) Electronic surveillance - FISA and FISA Title VII (acquisition of foreign intelligence 
information). (Section 18.7.31 

(U) Electronic surveillance - Title III. (Section 18.7.21 

(U) FISA Order for business records. (Section 18.6.71 

(U) Grand jury subpoenas. (Section 18.6.51 

(U) Grand jury subpoenas - for telephone or electronic mail subscriber information only in Type 
1 & 2 Assessments. (Section 18.5.91 

(U) Information voluntarily provided by governmental or private entities. (Section 18.5,71 

(U) Intercepting the communications of a computer trespasser. (Section 18.6.21 

(U) Interview or request information from the public or private entities. (Section 18.5.61 

(U) Mail covers. (Section 18.6.101 

(U) National Security Letters. (Section 18.6.61 

(U) On-line services and resources. (Section 18.5.41 

(U) Pen registers and trap/trace devices. (Section 18.6.91 

(U) Physical Surveillance (not requiring a court order). (Section 18.5.81 

(U) Polygraph examinations. (Section 18.6.111 
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(U) Public information. (Section 18.5.11 

(U) Records or information - FBI and DOJ. (Section 18.5.21 

(U) Records or information - Other federal, state, local, tribal, or foreign government agency. 
(Section 18.5.31 (U) Searches - with a warrant or court order. (Section 18.7.11 

(U) Stored wire and electronic communications and transactional records. (Section 18.6.81 

(U) Trash Covers (Searches that do not require a warrant or court order). (Section 18.6.121 

(U) Undercover Operations. (Section 18.6.131 

18.1.3 (U) General Overview 

(U//FOUO) The conduct of Assessments, Predicated Investigations (Preliminary Investigations 
and Full Investigations) and other activities authorized by the Attorney General’s Guidelines for 
Domestic FBI Operations (AGG-Dom) may present choices between the use of different 
investigative methods (formerly investigative “techniques”) that are each reasonable and 
effective based upon the circumstances of the investigation, but that are more or less intrusive, 
considering such factors as the effect on the privacy and civil liberties of individuals and the 
potential damage to reputation. The least intrusive method if reasonable based upon the 
circumstances of the investigation is to be used in such situations. However, the choice of 
methods is a matter of judgment. The FBI is authorized to use any lawful method consistent with 
the AGG-Dom, even if intrusive, where the degree of intrusiveness is warranted in light of the 
seriousness of a criminal or national security threat or the strength of the information indicating 
its existence, or in light of the importance of the foreign intelligence sought to the United States’ 
interests. (AGG-Dom, Part I.C.2.) 

(U) The availability of a particular investigative method in a particular investigation may depend 
upon the level of investigative activity (Assessment, Preliminary Investigation, Full 
Investigation, and Assistance to Other Agencies). 

18.2 (U) Least Intrusive Method 

(U) The AGG-Dom requires that the "least intrusive" means or method be considered and — if 
reasonable based upon the circumstances of the investigation — used to obtain intelligence or 
evidence in lieu of more intrusive methods. This principle is also reflected in Executive Order 
12333. which governs the activities of the United States intelligence community (USIC). The 
concept of least intrusive method applies to the collection of intelligence and evidence. 

(U) Selection of the least intrusive means is a balancing test as to which FBI employees must use 
common sense and sound judgment to effectively execute their duties while mitigating the 
potential negative impact on the privacy and civil liberties of all people encompassed within the 
Assessment or Predicated Investigation, including targets, witnesses, and victims. This principle 
is not intended to discourage investigators from seeking relevant and necessary intelligence, 
information, or evidence, but rather is intended to encourage investigators to choose the least 
intrusive — yet still reasonable — means from the available options to obtain the material. 
Additionally, FBI employees should operate openly and consensually with United States persons 
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(USPERs) to the extent practicable when collecting foreign intelligence that does not concern 
criminal activities or threats to the national security. 

(U) DIOG Section 4.4 describes the least intrusive methods concept and the standards to be 
applied by FBI employees. 

18.3 (U) Particular Investigative Methods 

(U//FOUO) All lawful investigative methods may be used in activities under the AGG-Dom as 
authorized by the AGG-Dom. Lawful investigative methods include those investigative methods 
contained in this DIOG as well as additional investigative methods and resources authorized in 
other FBI policy and guidance (for example, future additions to DIOG Sections 18, as well as 
Policy Implementation Guides). In some instances the authorized investigative methods are 
subject to special restrictions or review or approval requirements. (AGG-Dom, Part V.A.) 

18 . 3.1 (U) Use of Criminal Investigative Methods in National Security 

Investigations 

(U//FOUO) Because national security investigations may implicate criminal issues as well, the 
availability of criminal investigative methods should be considered when appropriate. However, 
any use of criminal investigative methods should be closely coordinated with FBIHQ, both 
operational units and the NSLB, prior to any anticipated use of this criminal investigative 
process. The NSLB maintains liaison with DOJ 01 respecting the use of FISA authorized 
investigative methods in national security investigations. 

18.4 (U) Information or Evidence Obtained in Assessments and Predicated 
Investigations 

(U) The use, retention and/or dissemination of information obtained during authorized 
investigations must comply with the AGG-Dom and the DIOG. If the originator of information 
reported to the FBI characterizes an individual, group, or activity in a certain way, and that 
characterization should be documented for completeness of the FBI record, the FBI record (i.e., 
302, EC, LHM) should reflect that another party, and not the FBI, is the originator of the 
characterization. 

(U) During the course of an Assessment or Predicated Investigation, FBI employees lawfully 
may collect or passively receive items of evidence or intelligence from a variety of sources. 
Experience has demonstrated that the relevance of every item of evidence or intelligence 
collected or received is not always apparent at the time it is obtained. Accordingly, FBI 
employees have wide latitude to establish or determine the relevance of information as the 
Assessment or investigation develops. Nevertheless, as a matter of administrative efficiency and 
sound business practice, if an FBI employee obtains an item of evidence which clearly is not 
relevant to the Assessment or investigation and there is no foreseeable future evidentiary or 
intelligence value of the item for the FBI or the USIC, the item should be returned or destroyed 
as circumstances warrant, with a record of the disposition documented in the file or on the FD-71 
or Guardian (FD-71a). In the alternative, such item of evidence may be sequestered in the 
investigative file. If it is later determined that the item of evidence is relevant, the item may be 
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used in the investigation upon such determination. The determination of relevancy will be made 
on a case-by-case basis with supervisory direction and may include consultation with the 
appropriate federal prosecuting office and/or the Chief Division Counsel (CDC) or the Office of 
the General Counsel (OGC). This policy does not supersede Sections 18.6.4.1.5 (Administrative 
Subpoenas); 18.6.5.1 (Federal Grand Jury Subpoena); 18.6.6.1.7 (National Security Letters); or 
18.6.7.1.6 (FISA Order for Business Records), or any requirement imposed by statute, regulation 
or other applicable law. 

18.5 (U) Authorized Investigative Methods in Assessments 


(U) See AGG-Dom, Part II.A.4. 



(U) In conducting an Assessment, only the following investigative methods are authorized: 


A) (U) Public information. (See Section 18.5.1) 

B) (U) Records or information - FBI and DOJ. (See Section 18.5.2) 

C) (U) Records or information - Other federal, state, local, tribal, or foreign government agency. 
(See Section 18.5.3) 

D) (U) On-line services and resources. (See Section 18.5.41 

E) (U) CHS use and recruitment. (See Section 18.5.5) 


F) (U) Interview or request information from the public or private entities. (See Section 18.5.6) 

G) (U) Information voluntarily provided by governmental or private entities. (See Section 18.5.7' 

H) (U) Physical Surveillance (not requiring a court order). (See Section 18.5.8) 

I) (U//FOUO) Grand jury subpoenas - for telephone or electronic mail subscriber information 
only (during a Type 1 & 2 Assessment) (See Sections 18.5.9 and 18.6.5) 


(U//FOUO) In Assessments, supervisory approval is required prior to use of the following 
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18 . 5.1 (U) Investigative Method: Public Information (“Publicly Available 

Information") 

(U) See AGG-Dom, Part II.A.4.a and Part VII.L. 

18.5.1.1 (U) Scope 

(U//FOUO) Public information is “Publicly Available Information” that is: 

A) (U) Published or broadcast for public consumption; 

B) (U) Available on request to the public; 

C) (U) Accessible on-line or otherwise to the public; 

D) (U) Available to the public by subscription or purchase; 

E) (U) Made available at a meeting open to the public; 

F) (U) Obtained by visiting any place or attending an event that is open to the public (e.g., public 
places); or 

G) (U) Observed, heard, smelled, detected or obtained by any casual observer or member of the 
public and does not involve unconsented intrusion into private places. 

(U//FOUO) The phrase “observed, heard, smelled, detected or obtained by any casual 
observer or member of the public” includes, for example, plain view observations; 
overhearing a conversation taking place at an adjacent table in a public restaurant; odor 
detection (by a person, drug dog, or technical device) emanating from a vehicle, in a public 
place, or from locations to which the employee has gained lawful access; searching property 
that has been intentionally abandoned, including property discarded in public trash containers 
or common dumpsters (but does not include a “trash cover” as set forth in DIOG Section 
18.6.12). 

(U//FOUO) The following are examples: 

1) (U) Viewing the vehicle identification number or personal property that is exposed to 
public view and may be seen when looking through the window of a car that is parked in 
an area that is open to and accessible by members of the public; 

2) (U) The examination of books and magazines in a book store or the purchase of such items. 
See Maryland v. Macon, 472 U.S. 463 (1985); and 

3) (U) A deliberate overflight in navigable air space to photograph marijuana plants is not a 
search, despite the landowner’s subjective expectation of privacy. See California v. 

Ciraolo, 476 U.S. 207 (1986). 

(U//FOUO) Note: Consent Searches are authorized in Assessments, as well as in Predicated 
Investigations. 

(U//FOUO) Note: If the originator of information reported to the FBI characterizes an 
individual, group, or activity in a certain way, and that characterization should be documented 
for completeness of the FBI record, the FBI record (i.e., 302, EC, LHM) should reflect that 
another party, and not the FBI, is the originator of the characterization. 
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18.5.1.2 (U) Application 

(U//FOUO)! 


18.5.1.3 (U) Approval 

(U//FOUO) Supervisory approval is not required for use of this method, except for the special 
rule for attending a religious service, even if it is open to the public. (See DIOG Section 
18.5.1.3.1) 


18.5.1.3.1 (U//FOUO) Special Rules: “Special Rule for Religious Services" and 

"Special Rule for Other Sensitive Organizations" 


18.5.1.3.1.1 (U//FOUO) Special Rule for Religious Services - regardless of 

WHETHER IT IS OPEN TO THE GENERAL PUBLIC 


A) (U//FOUO) In Assessments! 


n PJfcJl employee attending a religious service overtly 

must have SSA approval. Higher approvals may be required under certain circumstances, such 
as attendance that rises to the leve l of UDP (see DIOG Section 16) ] | 


B ) (U//FOUO) /« Predicated Investigations | j 

| | An FBI employee attending a religious service overtly must have SSA 

approval. Higher approvals may be required under c ertain circumstances, such as attendance 
that rises to the level of UDP (see DIOG Section 16)| | 

{see DIOG Section 18.6.13). 


1 8.5. 1 .3. 1 .2 (U//FOUO) Special Rule for Other Sensitive Organizations 

A ) (U//FOUO) In Assess ments^ 


B) (U//FOUO) In Predicated Investigations: 
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18.5.1.4 (U) Use/Dissemination 

(U//FOUO) The use or dissemination of information obtained by this method must comply 
with the AGG-Dom and DIOG Section 14. 


Version Dated: 
October 15, 2011 


18-8 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 



UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 


§18 


18.5.2 (U) Investigative Method: Records or Information - FBI and 

Department of Justice (DOJ) 

(U) See AGG-Dom, Part II.AAb. 

18.5.2.1 (U) Scope 

(U//FOUO) An FBI employee may access and examine FBI and other DOJ records and may 
obtain information from any FBI personnel or other DOJ personnel. Access to certain FBI 
records may be restricted to designated FBI personnel because of the sensitive nature of the 
information in the record, the classification of the record, or the tool used to gather the 
information contained in the record. These include, but are not limited to: FBI records 
concerning human source identification; espionage investigations; code word; other 
compartmented information; records that include raw FISA collections; and Rule 6(e) 
material. 

(U//FOUO) Note: If the originator of information reported to the FBI characterizes an 
individual, group, or activity in a certain way, and that characterization should be documented 
for completeness of the FBI record, the FBI record (i.e., 302, EC, LHM) should reflect that 
another party, and not the FBI, is the originator of the characterization. 

18.5.2.2 (U) Application 

(U//FOUO)! I b?E 


18.5.2.3 (U) Approval 

(U//FOUO) Supervisory approval is not required to use this method, except that if the use of 
records constitutes pattern-based data mining under the Federal Data Mining Reporting Act of 
2007, it must be reviewed and approved according to Section 18.5.2.4 below. 

18.5.2.4 (U) Pattern-Based Data Mining 

(U//FOUO) As used here, pattern-based data mining (PBDM) means queries or other analysis 
of electronic databases using two or more search criteria designed to discover or locate a 
predictive pattern or anomaly indicative of terrorist or criminal activity on the part of any 
individual or individuals (as defined in Corporate Policy Directive 03 10D). Any such analysis 
based solely on racial, ethnic, national origin or religious characteristics is strictly prohibited. 

(U//FOUO) For purposes of this requirement, pattern-based data mining does not include 
activities using one or more personal identifiers to identify an individual or analysis designed 
to discover links between a specific subject and unknown individuals or entities, even if the 
subject’s actual identity is not yet known. Pattern-based data mining does not include queries 
or analysis designed solely to identify potential human sources of intelligence nor does it 
include activities designed to identify an i ndividual or individuals associated with crimina l or 
terrorist activity that has already occurredl 
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|ln contrast, database queries using criterial I 

I I because the queries are being used to investigate a crime 

that has already occurred. Queries designed to identify individuals or entities who have had 
contact with a specific individual are not pattern-based data mining; rather, such queries are 
subject-based data mining, even if the specific individual’s actual identity is presently 
unknown. 

(U//FOUO) The majority of data analysis performed during FBI Assessments and Predicated 
Investigations is based on specific individuals or events and therefore does not constitute 
pattern-based data mining because it is either link analysis or is not predictive of future 
behavior. 

(U//FOUO) A Privacy Threshold Analysis (PTA) for pattern-based data mining must be 
completed and forwarded to the Privacy and Civil Liberties Unit, OGC. See the OGC Privacy 
PG for additional details. 

(U//FOUO) The Sensitive Operations Review Committee (SORC) must also receive notice of 
any proposal to use pattern-based data mining as defined above. Additionally, pursuant to the 
Federal Agency Data Mining Reporting Act of 2007, 13 the FBI must advise the DOJ of all 
agency initiatives that involve the use of PBMD, so that those activities may be included in 
the Department’s annual report to Congress. (See CPD 031 0D. “Pattern-based Data Mining 
Reporting Requirements) . 

18.5.2.5 (U) Use/Dissemination 

(U//FOUO) The use or dissemination of information obtained by this method must comply 
with the AGG-Dom and DIOG Section 14. 

(U//FOUO) The request for the records and the records received from DOJ and used during an 
Assessment or Predicated Investigation must be maintained as part of the appropria te file 

I ‘ I b7E 


13 (U) 42 U.S.C. § 2000ee-3 
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1 8.5.3 (U) Investigative Method: Records or Information - Other Federal, 

State, Local, Tribal, or Foreign Government Agency 

(U) See AGG-Dom, Part II.A.4.C. 

18.5.3.1 (U) Scope 

(U//FOUO) An FBI employee may access and examine records maintained by, and request 
information from, other federal, state, local, or tribal, or foreign governmental entities or 
agencies. When requesting information using this authority, care must be taken to ensure the 
entity to which the request is made understands that it is not compelled to provide such 
information or create a new record to assist the FBI. 

(U//FOUO) Note: If the originator of information reported to the FBI characterizes an 
individual, group, or activity in a certain way, and that characterization should be documented 
for completeness of the FBI record, the FBI record (i.e., 302, EC, LHM) should reflect that 
another party, and not the FBI, is the originator of the characterization. 

18.5.3.2 (U) Application 

(U//FOUO| 


18.5.3.3 (U) Approval 

(U//FOUO] | b7E 


(U//FOUO) Reguests to other Federal Agencies : The FBI may request, for a law 
enforcement purpose, that another federal agency disclose Privacy Act-protected records 
through a written request (5 U.S.C. 552a(b)(7)). Such written requests must be for a civil or 
criminal law enforcement purpose and must be made by the Director or his designee. (See 28 
CFR 16.40(c); OMB Guidelines, 40 Fed. Reg. at 28 sec. 955.) Pursuant to these provisions, 
the Director hereby delegates his authority to request formally from federal agencies 
information and records otherwise protected from disclosure by the Privacy Act, at FBIHQ, to 
all Section Chiefs and above, and in the field, to all SACs and ADICs. This authority may not 
be redelegated to a person below the rank of SAC in the field and SC in FBIHQ. 

(U) The FBI may also request another federal agency to disclose Privacy Act-protected 
records pursuant to that agency’s published routine uses. See 5 U.S.C. sec. 552a(b)(3). These 
requests need not be made in writing, and there are no restrictions on which FBI personnel 
may ask for such information. 

(U//FOUO) Reguests to Foreign Agencies : Requests for records or information from a 
foreign government entity or agency must be appropriately coordinated through the applicable 
FBI LEGAT office. International Operations Division (IOD), INTERPOL, relevant FBIHQ 
operational division, and/or DOJ Office of International Affairs, as necessary. Direct contact 
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with foreign government agencies is authorized in certain circumstances, such as an imminent 
threat situation. 

(U//FOUO) If the analysis of records obtained in this manner constitutes Pattern-based Data 
Mining (PBDM) under the Federal Data Mining Reporting Act of 2007, it must be reviewed 
and approved according to Section 18.5.2.3, above. 

(U//FOUO) Examvle\ | b7E 


18.5.3.4 (U) Use/Dissemination 

(U//FOUO) The use and/or dissemination of information obtained by this method must 
comply with the AGG-Dom and DIOG Section 14. 


(U//FOUO) The request for the records and the records received from an outside entity and 

used during an Assessment or Predicated Investigation must be maintained as part of the 

approp riate file 
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1 8.5.4 (U) INVESTIGA T1VE METHOD: ON-LlNE SERVICES AND RESOURCES 

(U) See AGG-Dom, Part II.A.4.d. 

18.5.4.1 (U) Scope 

(U//FOUO) An FBI employee may use any publicly available on-line service or resource 
including those that the FBI has obtained by subscription or purchase for official use, 
including services available only to law enforcement entities. 

(U//FOUO) Note: If the originator of information reported to the FBI characterizes an 
individual, group, or activity in a certain way, and that characterization should be documented 
for completeness of the FBI record, the FBI record (i.e., 302, EC, LHM) should reflect that 
another party, and not the FBI, is the originator of the characterization. 

18.5.4.2 (U) Application 

(U//FOUO) This investigative method may be used prior to opening an Assessment, in 
Assessments, Predicated Investigations, foreign intelligence collection investigations, and for 
assistance to other agencies. 

18.5.4.3 (U) Approval 

(U//FOUO) Supervisory approval is not required to use this method, although subscribing to 
or purchasing any new service or resource must be done according to FBI contracting 
procedures. 

(U//FOU O) Example: Publicly available on-line services or res ources include, but are not 
limited to ! l Onli ne resources that may be 

purchased by the FBI for official use include, but are not limited tol I 


18.5.4.4 (U) Use/Dissemination 

(U//FOUO) The use or dissemination of information obtained by this method must comply 
with the AGG-Dom and DIOG Section 14. 

(U) See DIOG Appendix L - On-line Investigations for additional information. 
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1 8.5.5 (U) Investigative Method: CHS Use and Recruitment 

(U) See AGG-Dom, Part II.A.4.e. 


18.5.5.1 (U) Scope 

(U//FOUO) The FBI may use and recruit human sources in Assessments and Predicated 
Investigations in conformity with the AGG-Dom, Attorney Ge neral Guidelines Regarding the 
Use of FBI Confidential Hu man Sources tAGG-CHSY the FBI \ I 


|and the FBI _ 

Jin this context, “use” means obtaining information from, tasking, or 


otherwise operating such sources. See AGG-Dom, Part VII.V. 


(U//FOUO) Note: If the originator of information reported to the FBI characterizes an 
individual, group, or activity in a certain way, and that characterization should be documented 
for completeness of the FBI record, the FBI record (i.e., 302, EC, LHM) should reflect that 
another party, and not the FBI, is the originator of the characterization. 


18.5.5.2 (U) Application 

(U//FOUO) This investigative method may be used in Assessments, Predicated Investigations, 
foreign intelligence collection investigations, and for assistance to other agencies when it is 
not otherwise prohibited by AGG-Dom, Part III.B.2. 

(U) When collecting positive foreign intelligence, the FBI must operate openly and 
consensually with an USPER, to the extent practicable. 

(U//FOUO) A CHS can be “used” in support of an Assessment and a Predicated Investigation 
or for the purpose of validating, vetting or determining the suitability of another CHS as part 
of an Assessment. 


18.5.5.3 (U) Approvals 

(U//FOUO) All investigative methods should be evaluated to ensure compliance with the 
admonition that the FBI should use the least intrusive method if reasonable based upon the 
circumstances of the investigation. That requirement should be particularly observed during 
an Assessment when using a CHS because the use of a CHS during an Assessment may be 
more intrusive than many other investigative methods. Use of a CHS in an Assessment should 
take place only after considering whether there are effective, less intrusive means available to 
obtain the desired information. The CHS must comply with all constitutional, statutory, and 
regulatory restrictions and limitations. In addition: 

A) (U//FOUO) CHS use and direction must be limited in focus and scope to what is necessary to 

accomplish t he authorized nnrnose and objective of the Assessment or Predicated 

Investigation] 


B ) (U//FOUO) During an Assessment , ! 1 

I [ see the Special Rule for Religious Services and the Special 

Rule for Other Sensitive Organizations below) only to the extent that such information is 
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necessary to achieve the specific objective of the Assessment. If such contact reveals 
information or facts about an individual, group or organization that meets the requirements to 
open a Predicated Investigation, a Predicated Investigation may be opened, as appropriate. 

C) (U//FOUO) Special Rule for Religious Services - regardless of whether it is open to the 
general public: 

1) (U//FOUO) In Assessments 

| | An FBI employee attending a religious service 

overtly must have SSA approval. Higher approvals may be required under certain 
circumstances, such as attendance that rises to the level of UD P (see DIOG Section 16). 


2 ) (U//FOUO) In Predicated Investigations : 

I l An FBI employee attending a religious service overtly must have 

SSA approval. Higher approvals may be required under certain circumstances, such as 
attendance that rises to th e level of UDP (see DIOG Section 16 ] 

I fsee DIOG Section 18.6.13). 

D) (U//FOUO) Special Rule for Other Sensitive Organizations: 

1) (U//FOUO ) In Assessments^ 


2) (U//FOUO) In Predicated Investigations , 


E) (U//FOUO) Public Information! 

| jfwiuch must be approved in accordance with DIOG 

Section 16)] 


b7E 


b7E 


b7E 


b7E 


b7E 


F) (U//FOUO) Non-Public Information: 

g; 


1 (U//F0U01 1 


IThls 


principle does not, however, eliminate the legal concept of a consent search or the doctrine of 
misplaced confidence. The doctrine of misplaced confidence provides that a person assumes 
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H) (U//FOUO) If there is any conflict between the | l or any other PG and the 

DIOG, the DIOG controls. OGC, OIC and CPO should be immediately notified of any such 
conflict. 


18.5.5.4 (U) Use/Dissemination 

(U//FOUO) The use or dissemination of inform ation obta ined by this method must comply 
with the AGG-Dom, DIOG Section 14, and the 


b7E 
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18.5.6 (U) Investigative Method: Interview or Request Information from 

the Public or Private Entities 

(U) See AGG-Dom, Part II.A.4.f; AGG-Dom, Part II.B.4. 

18.5.6.1 (U) Scope 

(U//FOUO) An interview is the questioning of an individual (to include a subject) in order to 
gather information that is pertinent to and within the scope of an authorized Assessment or 
Predicated Investigation. The initial questioning of a complainant is not an interview, nor is 
re-contacting a complainant to clarify information that was initially provided. Normally, an 
FBI employee should disclose the employee’s affiliation with the FBI and true purpose of the 
interview at the outset. The person being interviewed is voluntarily providing information and 
his/her Constitutional rights must be respected. FBI employees may not obtain a statement by 
force, threats, or improper promises. FBI employees have no authority to promise leniency or 
immunity from prosecution. Additionally, the interviewer should make reasonable efforts to 
obtain information that is accurate, relevant, timely, and complete. An interview may only 
elicit a description of how an individual exercises a right guaranteed by the First Amendment 
to the Constitution if such information is pertinent to and within the scope of an authorized 
activity; similarly, regardless of how such information is elicited, it may not be maintained in 
FBI files unless it is pertinent to and within the scope of an authorized activity. 

(U//FOUO) Nothing in this section prohibits asking for or accepting volunteered access to 
personal or real property. 

(U//FOUO) Note: “Consent Searches” are authorized in Assessments, as well as in Predicated 
Investigations. 

(U//FOUO) Note: If the originator of information reported to the FBI characterizes an 
individual, group, or activity in a certain way, and that characterization should be documented 
for completeness of the FBI record, the FBI record (i.e., 302, EC, LHM) should reflect that 
another party, and not the FBI, is the originator of the characterization. 

18.5.6.2 (U) Application 

I ru//Foiroi i b7E 


18.5.6.3 (U) Voluntariness 

(U//FOUO) Information that is sought during an interview must be provided voluntarily. FBI 
employees may not obtain a statement by force, threats, or improper promises. FBI employees 
have no authority to promise leniency or immunity from prosecution. If, during a non- 
custodial interview, the interviewee indicates he or she wishes to consult an attorney, the 
interviewer should assess whether continuing the interview would negatively affect the 
voluntariness of any further information provided. In determining whether a statement has 
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been given voluntarily, courts evaluate a “totality of the circumstances,” which may include 
consideration of the following factors: 

A) (U//FOUO) Whether the interviewee was notified of any charges against him/her or advised of 
his/her rights; 

B) (U//FOUO) The interviewee’s age, intelligence, experience, and physical condition; 

C) (U//FOUO) Whether there was any physical abuse or threats of abuse during the interview; 

D) (U//FOUO) The number of officers present and whether weapons were displayed during the 
interview; 

E) (U//FOUO) Whether threats or psychological pressure was used during the interview; 

F) (U//FOUO) Whether the interviewee was deprived of food, sleep, medication, or outside 
communication during the interview; 

G) (U//FOUO) The duration of the interview, and whether any trickery, ruse, or deception was 
used; and 

H) (U//FOUO) Whether there were any promises of leniency or other inducements made during 
the interview. 

(U//FOUO) See Sections 18.5.6.3.8, 18.5.6.3.9, and 18.5.6.4.13 below for additional 
considerations when interviewing juveniles. 

(U//FOUO) These factors are illustrative. The presence of any one or more of the factors 
mentioned above will not necessarily make a statement involuntary. 

18.5.6.4 (U) Approval / Procedures 

(U//FOUO) Generally, interviews do not require supervisory approval, except for: 

A) (U//FOUO) Circumstances involving the Advice of Rights in Connection with Operational 
Terrorists inside the United States (See Section 18.5.6.4.1.4 below); 

B) (U) Contact with Represented Parties (See Section 18.5.6.4.5 below); 

C) (U) Member of the U.S. Congress and their Staffs (See Section 18.5.6.4.6 below); 

D) (U) White House Personnel (See Section 18.5.6.4.7 below); and 

E) (U) Members of the News Media (See Section 18.5.6.4.8 below). 

(U//FOUO) No policy or PG may contradict, alter or otherwise modify the interview 
standards of the DIOG, i.e., requiring approvals for other types of interviews not specified 
above, etc. PGs may, however, require prior notice to FBIHQ for other interview types. 

18.5.6.4.1 (U) Custodial Interviews 

(U//FOUO) An FBI employee must advise a person who is in custody of his/her Miranda 
rights, per form FD-395, before beginning an interview inside the United States with the 
exception of questioning reasonably prompted by a concern for public safety (discussed 
below). It is critical that the person understand his/her rights before questioning. By signing 
the FD-395, the defendant acknowledges that he/she has been advised of his/her rights and is 
willing to proceed without a lawyer present. 
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(U//FOUO) A person is “in custody” for purposes of Miranda when his/her freedom of 
movement is significantly restricted. Custody can arise short of formal arrest when, judging 
from the totality of the circumstances, a reasonable person in the position of the interviewee 
would believe that he/she is in custody. A brief, temporary investigative detention is not 
custody provided it is reasonable in scope. In assessing whether a temporary detention is 
reasonable in scope and thus not custody for purposes of Miranda, factors to consider include 
the degree of force used to affect the detention, use of restraining devices and whether the 
individual was moved from the location of the stop. Employees can clarify custodial status by 
telling the person that he/she is not under arrest. 

1 8.5 .6.4. 1.1 (U) Miranda Warnings Required 

(U//FOUO) Miranda warnings are required when a person: 

A) (U//FOUO) Has been arrested and is in federal, tribal, state, or local custody; 

B) (U//FOUO) Is significantly restricted in his freedom of movement to a degree normally 
associated with a formal arrest; or 

C) (U//FOUO) Regardless of custody, has previously been formally charged, prosecution is 
pending, and the subject matter of the interview concerns the pending charge. 

(U//FOUO) For the purposes of Miranda, an interview refers to express questioning and any 
words or actions that are reasonably likely to elicit an incriminating response. In a custodial 
interview, the individual must be advised of the names and official identities of the 
employee(s) conducting the interview, the nature of the inquiry, and provided Miranda 
warnings, per the FD-395 form, before being interviewed. After being advised of his/her 
rights, if an interviewee who is in custody, invokes the right to counsel and/or the right to 
remain silent, this must be honored and the interview must cease. However, once the advice 
of rights is provided and it is evident that the interviewee understood those rights, the 
interview may proceed until such time as the interviewee invokes a right. While an 
affirmative waiver, including signing a waiver portion of the FD-395 is preferred, it is not 
required. Once the interviewee invokes his/or her right to remain silent and/or right to 
counsel, the interview must immediately be terminated. The fact that the interviewee invoked 
the right to counsel and/or the right to remain silent should be recorded on the FD-395 and the 
form should be executed in all other respects. 

1 8.5.6.4. 1 .2 (U) Miranda Warnings not Required 

(U//FOUO) There are certain custodial interviews in which the protection Miranda provides 
against self-incrimination may not be served by reading the standard warnings and obtaining a 
waiver. In the following circumstances, Miranda warnings are not required for custodial 
interviews: 

A) (U//FOUO) standard booking questions; 

B) (U//FOUO) an interview of the incarcerated individual as a victim or witness in an unrelated 
matter that does not pertain to any pending charges against the interviewee; 

C) (U//FOUO) the public safety exception (discussed in more detail below); and 
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D) (U//FOUO) in connection with arrests of operational terrorists inside the United States 
(discussed in more detail below). 

1 8.5.6.4. 1 .3 (U//FOUO) Public Safety Exception 

(U//FOUO) The warning and waiver of rights is not requir ed when questions are asked 
that are reasonably prompted by a concern for public safety! 


[ This public safety exception could also apply to other 
situations where imminent threat(s) to the safety of law enforcement officers or 
member(s) of the public could be alleviated by questions necessary to neutralize the 
threat. 

1 8.5.6.4. 1 .4 (U//FOUO) Advice of Rights In Connection With Arrests of 

Operational Terrorists Inside the United States 14 

(U//FOUO) Identifying and apprehending suspected terrorists, interrogating them to 
obtain intelligence about terrorist activities and impending terrorist attacks, and lawfully 
detaining them so that they do not pose a continuing threat to our communities are critical 
to protecting the American people. The DOJ and the FBI believe that we can maximize 
our ability to accomplish these objectives by continuing to adhere to FBI policy regarding 
the use of Miranda warnings for custodial interrogation of operational terrorists 15 who 
are arrested inside the United States: 

A) (U//FOUO) If applicable, agents should ask any and all questions that are reasonably 
prompted by an immediate concern for the safety of the public or the arresting agents without 
advising the arrestee of his Miranda rights . 16 

B) (U//FOUO) After all applicable public safety questions have been exhausted, agents should 
advise the arrestee of his/her Miranda rights and seek a waiver of those rights before any 
further interrogation occurs, absent the exceptional circumstances described below. 

C) (U//FOUO) There may be exceptional cases in which, although all relevant public safety 
questions have been asked, agents nonetheless conclude that continued unwarned interrogation 
is necessary to collect valuable and timely intelligence not related to any immediate threat, and 


14 (U//FOUO) This guidance applies only to arrestees who have not been indicted and who are not known to 
be represented by an attorney. For policy concerning the interrogation of indicted defendants, see Section 
18.5.6.4.1; and for policy concerning contact with represented persons, see DIOG Section 18.5.6.4.5. 

15 (U/ /FOUO) For these purposes, an operational terrorist is an arrestee who is reasonably believed to be 
either a high-level member of an international terrorist group; or an operative who has personally conducted 
or attempted to conduct a terrorist operation that involved risk to life; or an individual knowledgeable about 
operational details of a pending terrorist operation. 

16 (U//FOUO) The Supreme Court held in New York v. Quarles, 467 U.S. 649 (1984), that if law enforcement 
officials engage in custodial interrogation of an individual that is "reasonably prompted by a concern for the 
public safety," any statements the individual provides in the course of such interrogation shall not be 
inadmissible in any criminal proceeding on the basis that the warnings described in Miranda V. Arizona, 384 
U.S. 436 (1966), were not provided. The Court noted that this exception to the Miranda rule is a narrow one 
and that "in each case it will be circumscribed by the {public safety} exigency which justifies it." 467 U.S. at 
657. 
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that the government’s interest in obtaining this intelligence outweighs the disadvantages of 
proceeding with unwarned interrogation.' 7 

(U//FOUO) In these exceptional cases, agents must seek SAC approval, which cannot be 
delegated, to proceed with an unwarned interrogation after the public safety questioning is 
concluded. Whenever feasible, the SAC will consult with FBIHQ (including OGC) and DOJ 
attorneys before granting approval. Presentment of an arrestee may not be delayed simply to 
continue the interrogation, unless the arrestee has timely waived prompt presentment. 

(U//FOUO) The determination whether particular unwarned questions are justified on 
public safety grounds must always be made on a case-by-case basis based on all the facts 
and circumstances. In light of the magnitude and complexity of the threat often posed by 
terrorist organizations, particularly international terrorist organizations, and the nature of 
their attacks, the circumstances surrounding an arrest of an operational terrorist may 
warrant significantly more extensive public safety interrogation without Miranda 
warnings than would be permissible in an ordinary cri minal investigation. Dependin g on 
the facts, such interrogation might include, for example] 1 


(U//FOUO) As noted above, if there is time to consult with FBIHQ (including OGC) and 
Department of Justice attorneys regarding the interrogation strategy to be followed prior 
to reading the arrestee his Miranda rights, the field office should endeavor to do so. 
Nevertheless, the agents on the scene who are interacting with the arrestee are in the best 
position to assess what questions are necessary to secure their safety and the safety of the 
public, and how long the post-arrest interview can practically be delayed while 
interrogation strategy is being discussed. 

18.5.6.4.2 (U//FOUO) Miranda Warnings for Suspects in Custody Overseas 

(U//FOUO) The decision to use or not use Miranda warnings during an overseas custodial 
interrogation will have to be made on a case-by-case basis and weigh many factors. Overall, if 
there is a reasonable likelihood of a prosecution in a U.S. civilian criminal court of the person 
being interrogated while in custody overseas, agents should discuss with FBIHQ, FBI OGC, 
and DOJ whether warnings should be provided to the person being interrogated. Once the 
determination is made to provide Miranda warnings as part of an overseas custodial 
interrogation, if the person being interrogated invokes his right to remain silent or consult 
with an attorney, this invocation should be honored. If use of Miranda warnings is appropriate 

17 (U//FOUO) The Supreme Court has strongly suggested that an arrestee's Fifth Amendment right against 
self-incrimination is not violated at the time a statement is taken without Miranda warnings, but instead may 
be violated only if and when the government introduces an unwarned statement in a criminal proceeding 
against the defendant. See Chavez v. Martinez, 538 U.S. 760, 769 (2003) (plurality op.); id. at 789 (Kennedy, J., 
concurring in part and dissenting in part); cf. also id. at 778-79 (Souter, J., concurring in the judgment); See 
also United States v. Patane, 542 U.S. 630, 641 (2004) (plurality opinion) ("[V]iolations [of the Fifth 
Amendment right against self-incrimination] occur, if at all, only upon the admission of unwarned statements 
into evidence at trial."); United States v. Verdugo-Urguidez, 494 U.S. 259, 264 (1990) ("[A] violation [of the 
Fifth Amendment right against self-incrimination] occurs only at trial."). 
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given the circumstances of the case, the following DOJ-approved modified waiver form 
should be used. The form is the Standard Advice of Rights for Suspects in Foreign Custody . 

18.5.6.4.3 (U) Constitutional Rights to Silence and Counsel underMiranda 


A) (U//FOUO) Silence : If a custodial interviewee invokes his/her right to remain silent, FBI 
employees should not attempt a subsequent interview until a significant period of time has 
elapsed (a two-hour period has been held to be significant) or the interviewee requests to be 
interviewed anew. In either case, an FBI employee will ensure that the interviewee is again 
advised of his/her Miranda rights and indicates that he/she understand those rights before 
further questioning. If the interviewee again asserts his/her right to remain silent or the right to 
counsel, questioning must cease at that time. Assertion of the right to silence, like assertion of 
the right to counsel, must be unequivocal and unambiguous. A waiver of the right to remain 
silent occurs when an interviewee knowingly and voluntarily makes a statement; assertion of 
the right to remain silent requires more than mere silence in the face of questioning. This right, 
like the right to counsel, can be invoked at any time during custodial interrogation. Agents 
may continue questioning someone who has not clearly invoked his/her right to remain silent, 
but if the custodial interviewee asserts his/her right to silence, questioning must cease at that 
time. 

B) (U//FOUO) Counsel: If a custodial interviewee invokes his/her right to counsel, questioning 
must cease. FBI employees may not attempt a subsequent interview unless counsel is present, 
the custodial interviewee initiates contact, or there has been a break in custody of at least 14 
days. 

1) (U//FOUO) When a custodial interviewee who has invoked his/her right to counsel 
initiates a subsequent interview, an FBI employee must ensure that the interviewee is 
advised of and understands his/her Miranda rights before proceeding with the interview. 
Not every statement by a custodial interviewee can fairly be interpreted as initiating a 
subsequent interview. In order to constitute the initiation of an interview, the custodial 
interviewee must either directly request such or use words that are reasonably interpreted 
as expressing a desire to be interviewed. If the words used are ambiguous, the FBI 
employee should clarify the custodial interviewee’s intent by asking directly whether the 
custodial interviewee wants to be interviewed. The words and responses, if any, to such 
clarifying questions should be documented. General conversation by a custodial 
interviewee cannot be interpreted as indicating a desire to be interviewed and cannot be 
used standing alone to predicate a second interview after the right to counsel has been 
invoked. If the interviewee again asserts his/her right to counsel, or invokes his/her right to 
silence, questioning must cease at that time. 

2) (U//FOUO) When an uncharged and/or unrepresented interviewee who has previously 
invoked his/her right to counsel experiences a break-in-custody of at least 14 days, he/she 
may be approached for a subsequent interview. FBI employees, however, must ensure that 
the custodial interviewee is again advised of and waives his/her Miranda rights before 
proceeding with the interview. A break-in-custody for these purposes can occur even if an 
interviewee is continuously incarcerated. Questions as to what constitutes a break-in- 
custody should be directed to the CDC or OGC. 

3) (U//FOUO) Contact with a represented person outside the presence of his/her counsel may 
implicate state ethics rules for attorneys (AUSAs). Before making such contact, employees 
are encouraged to contact the CDC, OGC, or the USAO. Once a represented person has 
been charged, information may only be elicited from the person: 1) regarding an unrelated 
or uncharged matter or 2) when counsel is present. Questions as to whether an individual is 
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in fact represented or may be questioned as to a particular matter should be directed to the 
CDC or OGC. 

18.5.6.4.4 (U) Sixth Amendment Right to Counsel 

(U//FOUO) The Sixth Amendment Right to Counsel requires the government to advise and 
obtain a waiver of the Right to Counsel prior to interviewing the person to whom the right has 
attached. The Right to Counsel attaches upon indictment regardless of whether the indicted 
person realizes an indictment has been returned. The Right to Counsel also attaches upon the 
filing of information and at the time of an initial appearance on a Federal Complaint. The 
Right to Counsel is offense specific. When applicable, a warning regarding the Right to 
Counsel and subsequent knowing and voluntary waiver must occur prior to an interview, 
regardless of whether the person is in custody. Providing a person with a Miranda warning 
and obtaining a waiver per the use of Form FD-395 will permit the interview of the person 
after the Right to Counsel has attached. The Sixth Amendment right to counsel does not 
prohibit the government from re-contacting the subject if the subject refuses initially to waive 
this right or otherwise has requested or obtained counsel following an Initial Appearance. 

However, further attempts to interview the subject may be prohibited if the subject invoked 
his right to counsel and remained in continuous custody or there was an insufficient break in 

b7E 


18.5.6.4.5 (U) Contact with Represented Persons 

(U//FOUO) CDC or OGC review is required before contact with represented persons in the 
absence of prior notice to counsel . Such contact may implicate legal restrictions and affect the 
admissibility of resulting evidence. Hence, if an individual is known to be represented by 
counsel in a particular matter, the CDC must follow applicable law and DOJ procedure when 
reviewing the request to contact the represented individual in the absence of prior notice to 
counsel. The SAC, CDC, or their designees, and the United States Attorney or his or her 
designees must consult periodically on applicable law and DOJ procedure relative to contact 
with represented persons. The field office may raise inconsistent application of: (i) state ethics 
rules; or (ii) rules for contacts with represented persons with the USAO and request that it 
consult with the DOJ Professional Responsibility Advisory Office. (AGG-Dom, Part V.B.l) 

18.5.6.4.6 (U) Members of the United States Congress and their Staffs 
(U//FOUO) Generally, FBI employees may accept information offered from Congressional 
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18.5.6.4.7 (U) White House Personnel 

(U//FOUO) FBI employees may accept information offered by White House personnel just as 
they would accept information from other sources, and they may act upon it accordinelvJ 1 

| b7E 


Additional guidance 

regarding contact with White House personnel may be found in the AG Memorandum captioned 
“Communications with White House and Congress” dated May 1 1, 2009. (See DIOG Appendix 

D j Note: 1 l 




18.5.6.4.8 (U) Members of the News Media 


18.5.6.4.8.1 (U) Approval Requirements 

18.5.6.4.8.1.1 (U) General Requirements 

(U//FOUO) Attorney General approval must be obtained prior to conducting an interview 
of a member of the news media for any offense which the member of the news media is 
suspected of having committed in the course of, or arising out of, the coverage or 
investigation of a news story, or while engaged in the performance of his/her official 
duties as a member of the news media. Requests for this approval must be submitted with 
an EC to the AD of the operational FBIHQ division that is responsible for the 
investigative classification and the AD of the Office of Public Affairs (OP A). The 
requesting EC must be reviewed by the CDC and approved by the SAC after coordinating 
the request with the local USAO. The EC must contain the necessary facts and 
investigative justification for the interview consistent with the DOJ guidelines set forth in 
28 C.F.R. §50.10. 

18.5. 6.4.8.1.2 (U) Emergency^ Qrcumstances Requirements 

(U//FOUO) In emergency circumstances, an Agent may interview a news media 
representative concerning an offense which the member of the news media is suspected 
of having committed in the course of, or arising out of, the coverage or investigation of a 
news story, or while engaged in the performance of his/her official duties as a member of 
the news media without prior AG approval, if authorized by the SAC and the United 
States Attorney. Immediate notification of the interview, the emergency circumstances 
that justified proceeding without prior authorization and all the information that would 
have been provided if prior authorization had been sought shall be communicated 
immediately to the AD of the FBIHQ operational division, the AD of the OP A, and the 
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General Counsel. The AD of the operational division is responsible for notifying the 
appropriate officials at DOJ as set forth in 28 C.F.R. 50.10. After these oral notifications 
have been made, the field office is responsible for providing written documentation to the 
FBIHQ operational division AD as soon as practicable, but not more than 24 hours after 
the interview. FBIHQ is responsible for providing appropriate written documentation to 
the DOJ approval authorities to whom oral notice was given. 

18.5.6.4.8.2 (U) Use of Subterfuge 



After consultation with the OPA and OGC, the AD of the operational division must 
decide whether to approve the request. If the request requires approval by DOJ (because 
the interview is related to an offense committed by the member of the news media during 
the course of news gathering) the AD of the operational division is responsible for 
submitting all requests for approval to the DOJ per 28 C.F.R. 50.10. 

(U//FOUO) FBIHQ operational division PGs may contain additional notice requirements. 

18.5.6.4. 9 (U) During an Assessment - Requesting Information without Revealing FBI 

Affiliation or the True Purpose of a Request 
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3) (U//FOUOJ 


4) (U//FOUOJ 



7) (U//FOUOJ 



(U//FOUO) 
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18.5.6.4.11 (U) Examples 

18.5.6.4.11.1 (U) Example 1 

(U//FOUO)! 
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(U//FOUOI 

□ 

1 


18.5.6.4.11.5 (U) Example 5 


(U//FOUOI 

HI 





(U//FOUO)! 




18.5.6.4.11.6 (U) Example 6 


CU//FOUO') 






(U//FOUC 




18.5.6.4.11.7 (U) Example 7 



(U//FOUQ1I ~~l 
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18.5.6.4.13 (U) Interviews of Juveniles 

(U//FOUO) When determining whether to interview a juvenile (anyone under the age of 
eighteen) who does not fall within the provisions of the JDA above, e.g., when interviewing a 
juvenile as a witness or subject prior to arrest, and, if so, determining the scope and tactics 
that will be used, the FBI employee should consider the age and competency of the juvenile, 
whether the juvenile is emancipated, the juvenile’s relationship to the suspect(s), safety 
concerns, the gravity of the offense at issue, any alternative sources of evidence, the 
importance of the information or potential testimony to the investigation, and the juvenile’s 
degree of involvement, if any, with the offense. If the interview is custodial, compliance with 
the provisions of the Juvenile Delinquency Act (JDA) below is necessary. In determining 
whether a juvenile is in custody the test remains an objective test -was there a formal arrest or 
a deprivation of freedom of movement equivalent to an arrest. However, with respect to 
juveniles, if the juvenile’s age is known to the interviewer or is objectively apparent, the 
juvenile’s age is to be considered in the custody analysis. This is not to say that age is the 
determining or decisive factor in every case, but it recognizes that age is to be considered 
given a reasonable adult may view the circumstances surrounding the interview differently 
than a reasonable juvenile. If the juvenile is placed under arrest, the procedures listed in 

18.5.6.4.14 must be followed. If not under arrest, but based on the objective circumstances 
surrounding the interview, including the juvenile’s age, the juvenile is deemed to be in 
custody, the interviewer should advise the juvenile of their rights as set forth in the FD-395 
and cease the interview if the juvenile invokes a right. Parental consent for a juvenile 
interview should be obtained when feasible under the circumstances of the investigation. 

A) (U//FOUO) Special consideration should be given to child interviews and to interviews of 
juveniles who are of a tender age, maturity, or have a significant developmental disability. To 
the extent appropriate, agents should make use of local child protective services to aid in 
interviewing a child — especially for an offense involving sexual exploitation of the child. The 
agents should consider seeking approval to video and/or audio record child interviews to 
address potential allegations that the child was manipulated and to have an unimpeachable 
record in case the child’s statement changes. 

B) (U//FOUO) Federal statutes and the Attorney General Guidelines on Victim and Witness 
Assistance require federal investigators to utilize sensitive and developmentally appropriate 
practices designed to elicit the most accurate information from child victims and witnesses and 
to reduce unnecessary and additional trauma to these children. An interview should be 
appropriate for the age and developmental level of the child. It may be advisable in some 
instances for FBI employees to seek assistance with interviewing children - possibly by 
utilizing local child protective services - particularly, when the child is very young, 
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developmental^ disabled, or extremely traumatized. Interviews of child victims and 
witnesses, regardless of the type of crime, should be conducted by personnel properly trained 
in the techniques designed to best elicit accurate information from a child while minimizing 
additional trauma. 

18.5,6.4.14 (U) Interviews of Juveniles After Arrest 

(U//FOUO) Under the Juvenile Delinquency Act (JDA), a juvenile is anyone who commits a 
federal crime before his or her eighteenth birthday and who has not yet reached age twenty- 
one (21) before being charged. The provisions of the JDA, 18 U.S.C. § 5031 et seq., apply 
upon arrest. 

A) (U//FOUO) Whenever a juvenile is arrested for a violation of federal law, he/she must be 
immediately advised of his/her legal rights and the United States Attorney must be notified. 
The juvenile’s parents, guardian or custodian must also be immediately notified of his/her 
arrest as well as his/her rights and the nature of the alleged offense. After notification has been 
made, FBI employees must allow a parent, guardian, or custodian access to the juvenile if 
requested by the juvenile or by a parent, guardian or custodian of the juvenile. The juvenile 
must be promptly taken before a magistrate if a magistrate is available. If no magistrate is 
immediately available, the juvenile must be taken to a magistrate without undue delay. 

B) (U//FOUO) Whether a juvenile may be interviewed for a confession or admission of his own 
guilt between the time of his arrest for a federal offense and his initial appearance before the 
magistrate depends on the law of the circuit in which the arrest occurs. If the interrogation is 
not allowed under the law of the circuit, information volunteered by the arrested juvenile 
concerning his own guilt should be recorded in the FBI employee's notes for use in subsequent 
proceedings; clarifying questions may be asked as necessary to make certain the FBI 
employee correctly understands what the juvenile intends to say. The volunteered statement 
may be reduced to writing if such action does not involve any delay in the juvenile's 
appearance before the magistrate. Any questions concerning the law that applies in the 
particular circuit should be directed to the CDC. 

C) (U//FOUO) A juvenile may be questioned concerning the guilt of a third party if such 
questioning does not cause any delay in bringing him/her before the magistrate. 

D) (U//FOUO) These special requirements apply only after the arrest of a juvenile, as defined by 
federal law, for a federal offense. They do not apply when the juvenile is under arrest by state 
or local officers on a state or local charge but is suspected of having committed a federal 
offense. FBI employees may question a juvenile in custody on a non-federal charge about a 
federal offense for which he/she is a suspect. FBI employees are cautioned, however, that they 
may not collude or create the appearance of collusion with non-federal officers to delay an 
arrest on federal charges to circumvent the JDA requirements. 

E) (U//FOUO) A juvenile may waive his Fifth Amendment rights and consent to a post-arrest 
custodial interview if permitted by the law of the circuit. Whether a waiver is knowing and 
voluntary will be determined based on the totality of the circumstances surrounding the 
interview. Among the factors the court will likely consider are the juvenile’s age, experience, 
education, background, and intelligence, and whether he/she has the capacity to understand the 
warnings given, the nature of Fifth Amendment rights, and the consequences of waiving them. 
The presence and co-signature of a parent or guardian during the waiver of rights (FD-395) is 
not required for a voluntary waiver, although it is a factor to be considered and might help 
dispel any notion that the juvenile was coerced. The AUSA must approve a post-arrest 
custodial interview of a juvenile. 
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18.5.6.4.15 (U) Documentation 


(U//FOUO) When it is anticipated that the results of an interview mav become the subject of 
court tes timony, the in terview mu st be recorded on an FD-302 or| 


[The FD-302 oH 


Jmust contain a record of statements made by the interviewee. 


Analysis or contextual comments regarding an interviewee’s statements should be 
documented in a companion EC or other appropriate format. If the interviewee characterizes 
an individual, group, or activity in a certain way, FBI records (i.e., 302s, ECs, LHMs) should 
reflect that the interviewee, not the FBI, is the source of the characterization. 


(U//FOUO) Certain types of written material developed during the course of an interview 
must be retained including: 


A) (U//FOUO) Written statements signed by the witness. When possible, written statements 
should be taken in all investigations in which a confession or admission of guilt is obtained 
unless the confession is obtained during an electronically-recorded interview session. If a 
witness gives a signed statement, and then gives additional informatio n orally, both the signed 
statement and the oral information should be recorded on an FD-302 oi 


B) (U//FOUO) Written statements, unsigned by the witness, but approved or adopted in any 
manner by the witness. An example of such a written statement would be a written statement 
that the subject orally admits is true but will not sign; and 


C) (U//FOUO) Original notes of an interview when the results may become the subject of court 
testimony. Materials generated via email, text messages, or similar means during an online 
interview must be retained as original notes. Because some forms of synchronous 
communication tools, such as text messaging, have limited or no storage, print, or production 
capabilities, they should not be used for substantive communications with law enforcement 
colleagues or civilians who may become witnesses. If these tools are, nonetheless, used for 
substantive communications as part of an interview, the communications must be 
memorialized verbatim in an FD-302. 


D) (U//FOUO) If an FBI employee and an AUSA conduct an interview, and the AUSA asks or 
tells the FBI employee to refrain from recording the substance of the interview or taking notes, 
the FBI employee should decline to participate in the interview and should not be present 
when it takes place unless the interview is part of the trial preparation of the witness (or unless 
another law enforcement agent present is given the responsibility for taking notes and 
documenting the substance of the interview). FBI employees generally do not report the 
substance of trial preparation unless new material information or impeachment information is 
developed. FBI employees should consult with the trial AUSA to determine how to document 
any new information, including impeaching information, developed during the trial 
preparation interviews. 

(U) See also DIOG Section 3.3.1.14 (Retain Original Notes During Investigation). 


18.5.6.4.16 (U) Electronic Recording of Interviews 


(U//FOUO) Special Agents must obtain ASAC approval (which may not be delegated) prior 
to recording interviews during Assessments and Predicated Investigations. The requirement to 
obtain approval is not intended to discourage recording or to indicate that the FBI disfavors 
recording. Indeed, there are many circumstances in which audio or video recording of an 
interview may be prudent. Approval to electronically record an interview must be documented 
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on a FD-759. When recording a custodial interview, the recording should include an advice 
and waiver of Miranda rights, as well as a question and answer segment designed to 
demonstrate that the interviewee’s statements are voluntary and not the product of coercion. 

(U//FOUO) After completing the recorded interview, the agent must document the fact that 
the interview took place in an FD-302, noting the official identity of the interviewing agent(s) 
was provided, the purpose of the interview, the identity of the individual recorded and the 
details of the recording session (e.g., date, time, start and stop periods, reasons for stopping). 
FBI employees may include a summary of the recording in the FD-302 if doing so will aid 
them in the management of the investigation. Transcription of the recording is optional. 

(U) See also DIOG Section 3.3.1.14 (Retain Original Notes During Investigation). 

(U//FOUO) Establishing within a field office reasonable standards for the types of 
investigations, crimes, circumstances, and subjects for which recording may be desirable will 
help maintain internal consistency. The following factors will assist the ASAC in determining 
whether to approve a request to record interview or interviews. These factors should not be 
viewed as a checklist; they are not intended to limit the discretion of the approving official 
and are not intended to suggest that there is a presumption against recording. 

A) (U//FOUO) Whether the purpose of the interview is to gather evidence for prosecution, or 
intelligence for analysis, or both; 

B) (U//FOUO) If prosecution is anticipated, the type and seriousness of the crime, including, in 
particular, whether the crime has a mental element (such as knowledge or intent to defraud), 
proof of which would be considerably aided by the defendant's admissions in his own words; 

C) (U//FOUO) Whether the defendant's own words and appearance (in video recordings) would 
help rebut any doubt about the voluntariness of his confession raised by his age, mental state, 
educational level, or understanding of the English language; or is otherwise expected to be an 
issue at trial, such as to rebut an insanity defense; or may be of value to behavioral analysts; 

D) (U//FOUO) If investigators anticipate that the subject might be untruthful during an interview, 
whether a recording of the false statement would enhance the likelihood of charging and 
convicting the person for making a false statement; 

E) (U//FOUO) The sufficiency of other available evidence to prove the charge beyond a 
reasonable doubt; 

F) (U//FOUO) The preference of the USAO and the Federal District Court regarding recorded 
confessions; 

G) (U//FOUO) Local laws and practice-particularly in task force investigations where state 
prosecution is possible; 

H) (U//FOUO) Whether interviews with other subjects in the same or related investigations have 
been electronically recorded; and 

I) (U//FOUO) The potential to use the subject as a cooperating witness and the value of using his 
own words to elicit his cooperation. 
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18.5.6.4.1 7 (U) Interviews Relating to Closed Files 

(U//FOUO) An interview initiated by an employee should only be conducted if it is within the 
scope of an open authorized Assessment or Predicated Investigation. On the other hand, there 
are situations in which an individual contacts the FBI to report information concerning a 
matter that has been closed or placed in a zero file classification, or is unrelated to any current 
or previous investigation. In these situations, an FBI employee may collect whatever 
information the person is willing to provide, except solely First Amendment information, and 
may document the results of the contact in an FD-7 1/Guardian, or with an EC or FD-302. 
These documents may be serialized in files that are relevant to an open Assessment or 
Predicated Investigation, a closed Assessment or Predicated Investigation, a zero 
classification file, or a control file (if no further investigative activity is required). 

('U//FOUQ1 
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18.5.6.4.18 (U) FBIHQ Operational Division Requirements 

A) (U//FOUO ) Counterintelligence Divi sion ;l 


B) (U//FOUO) Other FBIHQ Divisions : Each FBIHQ division may provide additional interview 
notice requirements in its PG. 

18.5.6.5 (U) Use/Dissemination 

(U//FOUO) The use or dissemination of information obtained by this method must comply with 
the AGG-Dom and DIOG Section 14. 
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18.5. 7 (U) Investigative Method: Information Voluntarily Provided by 

Governmental or Private Entities 

(U) See AGG-Dom, Part II.A.4.g. 

18.5.7.1 (U) Scope 

(U//FOUO) An FBI employee may accept information voluntarily provided by federal, state, 
local, tribal, or foreign governmental or private entities and individuals. Voluntarily provided 
information includes, but is not limited to, oral as well as documentary and physical evidence 
such as a computer hard drive or other electronic media that contains information, paper 
documents containing information, or physical objects (e.g., handgun or narcotics). 

(U//FOUO) Nothing in this section prohibits asking for or accepting volunteered access to 
personal or real property. 

(U//FOUO) Note: Consent Searches are authorized in Assessments, as well as Predicated 
Investigations. 

(U//FOUO) Note: If the originator of information reported to the FBI characterizes an 
individual, group, or activity in a certain way, and that characterization should be documented 
for completeness of the FBI record, the FBI record (i.e., 302, EC, LHM) should reflect that 
another party, and not the FBI, is the originator of the characterization. 

18.5.7.2 (U) Application 

(XJ//FOUOH I b7E 


18.5.7.3 (U) Approval 

(U//FOUO) Supervisory approval is not required to accept voluntarily provided information. 
Personnel may not request nor knowingly accept information where disclosure would be 
prohibited by federal law. See, e.g., 18 U.S.C. § 2702 (prohibiting an entity providing 
electronic communications services from divulging certain communications and other 
records, except in certain circumstances). 

18.5.7.4 (U) Use/Dissemination 

(U//FOUO) The use or dissemination of information obtained by this method must comply 
with the AGG-Dom and DIOG Section 14. 
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18.5.8 (U) Investigative Method: Physical Surveillance (not requiring a 

COURT ORDER) 

(U) See AGG-Dom, Part II.AAh - “Engage in observation or surveillance not requiring a court 
order.” Note: Consent Searches are authorized in Assessments. 

(tq 


18.5.8.1 (U) Scope 

(U//FOUO) Physical Surveillance Defined : Physical surveillance is the deliberate 
observation of persons, places, or events, on either a limited or continuous basis, in areas 
where there is no reasonable expectation of privacy. 

(U//FOUQ1 


(U//FOUOf 


A ) (UZ/FOUCOf 



D) (U//FOUO)f 
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(U//FOUO) Surveillance Enhancement Devices : The use of mech anical devices onerated by 
the user (e.g., binoculars: hand-held photographic or video cameras] 

|is authorized as 

part of physical surveillance provided that the device i s not used to collect information in 
which a person has a reasonable expectation of privacy! I 
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18.5.8.3 (U) Approval 

(U//FOUO) Durin g an Asses sment, physical surveillance may be approved for a period of 
time not to exceed as explained further below. 


18.5.8.3.1 (U//FOUO) Standardsfor Opening or Approving Physical Surveillance 

During an Assessment 

(U//FOUO) During an Assessment, in addition to the standards contained in DIOG Sections 

5.5 and 5.8, the FBI employee and supervisor must consider the following: 

A) (U//FOUO) Whether the physical surveillance is rationally related to the articulated purpose 
and objective of the Assessment; 

B) (U//FOUO) Whether the physical surveillance is the least intrusive alternative for acquiring 
needed information; 

C) (U//FOUO) If the physical surveillance is for the purpose of determining a pattern of activity, 
whether there is a logical nexus between the purpose of the Assessment and the pattern of 
activity the employee is seeking to determine; and 


D) (U//FOUO) If being conducted in order to gather positive foreign intelligence, whether the 
surveillance is consistent with the requirement that the FBI employee operate openly and 
consensually with a USPER, to the extent practicable. 
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18.5.8.3.3 

(U//FOUO} 





oj/zfouotI 

in an FD-71, Guardian, an 


approval. (Note: The 


approval standard, renewable for additional] 



18.5.8.3.4 


OJ//FOUO' 


18.5.8.3.4.1 (U//FOUO) APPROVAL REQUIREMENTS 


(U//FOUO)| 

must document the reason and 

objective for its use and be approved by an ASAC. The request and approval must be 
documented in a | 

form and serialized into the appropriate investigative file. 

18.5.8.3.4.2 (U//FOUO) 


Guardian, an EC, or other appropriate 


qj//FOUOf 
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(U//FOUO] 


(U//FOUO; 
l) . mz/Foumf 

2 \(U//FOUOir 


3) (U//FOUOJ 
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Note: fU//FOUOi I 


18.5.8.3.4.4 (U//FOUO) Compliance and Monitoring 

(U//FOUO) The request and approval documentation for the use of 
must be serialized into the appropriate investigative file. 

18.5.8.4 (U) Other Physical Surveillance 

(U//FOUO) Physical surveillan ce conducted bv employees, oth er than through use of the 
resources discussed above fi.e. l I during a Predicated 

Investigation does not require supervisory approval. In addition! 


18.5.8.5 (U) Maintain a "Surveillance Log" during Physical Surveillance 

(U//FOUO) A surveillance log must generally be maintained for the purpose of documenting 
observations made during the period of physical surveillance. The log is a chronological 
narrative detailing the observations noted during the surveillance. A team member must be 
assigned to maintaining the surveillance log. At the end of the shift, each individual must 
initial on the surveillance log the notations of the activities he or she observed. Completed 
physical surveillance logs must be serialized in the investigative main file or in the FISUR 
sub-file, if the sub-file has been opened for the investigation. Any original notes must be 
permanently retained in a 1A envelope (FD-340a) in the investigative file. Surveillance logs 
must be concise and factual. When reporting locations, the surveillance log must be as 
specific as possible. Surveillance team members must avoid over-reporting and including 
unnecessary information; logs are subject to discovery in legal proceedings. 

18.5.8.6 (U) Use/Dissemination 

(U//FOUO) The use or dissemination of information obtained by this method must comply 
with the AGG-Dom and DIOG Section 14. 
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1 8.5. 9 (U) Investigative Method: Grand Jury Subpoenas - for telephone or 

ELECTRONIC MAIL SUBSCRIBER INFORMATION ONLY (IN TYPEl &2 

Assessments) 

(U) See AGG-Dom, Part II.A.4.L 

(U) See DIOG Section 18.6.5 for additional information on use of Federal Grand Jury (FGJ) 
subpoenas in Predicated Investigations. 

18.5.9.1 (U) Scope 

(U//FOUO) During a Type 1 & 2 Assessment, an FBI employee may request from an 
appropriate USAO the issuance of a FGJ subpoena for the limited purpose of obtaining 
subscriber information associated with a telephone number or e-mail address. A FGJ 
subpoena, under this provision, may not be requested for the purpose of collecting foreign 
intelligence. For more information regarding FGJ subpoenas, see DIOG Section 18.6.5. 

18.5.9.2 (U) Application 

(U//FOUQ1 ' 


b7E 


18.5.9.3 (U) Approval 

(U//FOUO) In Type 1 & 2 Assessments, telephone and electronic mail subscriber information 
may be requested through the use of an FGJ subpoena without supervisory approval. An agent 
requesting a grand jury subpoena during an Assessment must advise the AUSA, who will 
issue the subpoena, that the FBI is conducting an Assessment. The AUSA must determine 
whether there is sufficient connection between the Assessment and possible criminal conduct 
to warrant issuance of a FGJ subpoena. FGJ subpoenas may not be sought during a Type 3, 4, 
5, or 6 Assessment. 

18.5.9.4 (U) Electronic Communications Privacy Act (ECPA) (18 U.S.C. §§ 2701- 
2712) 

(U//FOUO) 18 U.S.C. § 2703(c)(2) states that “a provider of electronic communication 
service or remote computing service shall disclose to a governmental entity the: (i) name; (ii) 
address; (iii) local and long distance telephone connection records, or records of sessions, 
times and durations; (iv) length of service (including start date) and types of service utilized; 
(v) telephone or instrument number or other subscriber number or identity, including any 
temporarily assigned network address; and (vi) means and source of payment for such service 
(including any credit card or bank account number), of a subscriber to or customer of such 
service when the governmental entity uses a Federal Grand Jury subpoena.’! 


See DIOG Sections 18.6.4- 18.6.8. 
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18.5.9.5 (U) Use/Dissemination 

(U//FOUO) Because judicial districts vary as to whether subscriber records obtained through 
use of a FGJ subpoena must be handled pursuant to the FGJ secrecy rules as “matters before 
the grand jury,” subscriber records obtained pursuant to a FGJ subpoena should be protected 
as required by the judicial district (e.g., USAO) in which the FGJ subpoena is issued. In 
addition, in those judicial districts in which subscriber records obtained pursuant to a FGJ 
subpoena are considered to be “matters before the grand jury,” no documentation of the actual 
subscriber records should be made in the FD-71 or Guardian. Instead, a copy of the FGJ 
subpoena and the responsive subscriber records must be filed in a 1 A, IB, or 1C and 
serialized to the GJ sub-file. Due to developing law on this issue, employees should consult 
with the AUSA to determine whether such documents are considered to be FGJ materials and 
must handle them accordingly. The use or dissemination of information obtained by this 
method must comply with the AGG-Dom, DIOG Section 14, and the Federal Rules of 
Criminal Procedure (FRPC) Rule 6. 
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18.6 (U) Authorized Investigative Methods in Preliminary Investigations 


(U) See AGG-Dom, Part II.B and Part V.A.1-10. 

(U) In Preliminary Investigations the authorized methods include the following: 

A) (U) The investigative methods authorized for Assessments: 

1) (U) Public information. (See Section 18.5.1! 

2) (U) Records or information - FBI and DOJ. (See Section 18.5.2! 

3) (U) Records or information - Other federal, state, local, tribal, or foreign government 
agency. (See Section 18.5.3! 

4) (U) On-line services and resources. (See Section 18.5.4! 

5) (U) CHS use and recruitment. (See Section 18.5.5! 

6) (U) Interview or request information from the public or private entities. (See Section 
18.5.6! 

7) (U) Information voluntarily provided by governmental or private entities. (See Section 
18.5.7! 

8) (U) Physical Surveillance (not requiring a court order). (See Section 18.5.8! 

B) (U) Consensual monitoring of communications, including electronic communications. (See 
Section 18.6.1! 

C) (U) Intercepting the communications of a computer trespasser. (See Section 18.6.2 ) 

D) (U) Closed-circuit television/video surveillance, direction finders, and other monitoring 
devices. (See Section 18.6.3! 

E) (U) Administrative subpoenas. (See Section 18.6.4! 

F) (U) Grand jury subpoenas. (See Section 18.6.5! 

G) (U) National Security Letters. (See Section 18.6.6! 

H) (U) FISA Order for business records. (See Section 18.6.7! 

I) (U) Stored wire and electronic communications and transactional records. (See Section 
18.6.8! 18 

J) (U) Pen registers and trap/trace devices. (See Section 18.6.9! 

K) (U) Mail covers. (See Section 18.6.10! 

L) (U) Polygraph examinations. (See Section 18.6.1 1! 

M) (U) Trash Covers (Searches that do not require a warrant or court order). (See Section 18.6.12! 

N) (U) Undercover operations. (See Section 18.6.13! 


18 (U//FOUO) The use of Search Warrants to obtain this information in Preliminary Investigations is 
prohibited. (See DIOG Section 18.6.8.4.2.3) 
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18.6.1 (U) Investigative Method: Consensual Monitoring of 

Communications, including Electronic Communications 

18.6.1.1 (U) Summary 

(U) Monitoring of wire, oral or electronic communications based on the consent of one party 
to the communication is referred to as consensual monitoring. The consent exception applies 
to the interception of wire, oral, and electronic communications. Consensual monitoring 
requires review by the CDC or the OGC. (AGG-Dom, Part V.A.4) 


18.6.1.2 (U) Application 



(U//FOUO) The law of the state or territory where the consenting party is located when 
making the recording will govern whether QIA approval is needed. 


(U//FOUO) See the OGC website for a list of all-party consent states. See also DIOG Section 
18.6.1.6, below. 

(U//FOUO) See Advanced Electronic Surveillance and Searches Policy and Policy 
Implementation Guide (DPG0626) for additional guidance here . 

18.6.1.3 (U) Legal Authority 

A) (U) The Fourth Amendment to the United States Constitution and case law interpreting the 
same; 

B) (U) The Wiretap Statute, 18 U.S.C. § 2511-2522 , prohibits the intentional interception and 
use of wire, voice, or electronic communications absent an exception; 

C) (U) The consensual monitoring exceptions, 18 U.S.C. § 251 l(2)(c) & (d), require one party to 
the communication to consent to monitoring; and 

D) (U) The Foreign Intelligence Surveillance Act of 1978 (FISA), 50 U.S.C. §§ 1801 et seq. 
provides that if a party to the communication has consented to monitoring, a FISA court order 
is not required. 
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18.6.1.4 (U) Definition of Investigative Method 

(U) Generally, the Wiretap Statute (also referred to as Title III), 18 U.S.C. §§ 2510-2522, 
prohibits the intentional interception of wire, oral, or electronic communications unless one of 
several exceptions applies. One such exception is based on the consent of a party to the 
communication. Two other statutory exceptions to the general prohibition include 1) the 
warrant or court order exception, and 2) the computer trespasser exception. This section 
discusses the monitoring of communications under the consent exception. 

(U) Consensual monitoring is the monitoring of communications based on the consent of a 
party to the communication. (AGG-Dom, Part VILA.) For purposes of this policy, at least one 
of the parties to the communication must be located, or the interception of the consensual 
communication must occur, within the United States or the United States territories. The 
consensual monitoring of communications is subject to legal review by the CDC or OGC, as 
applicable. (AGG-Dom, Part V.A.4). Consensual monitoring includes the interception of the 
content of communications and typically falls into one of three general categories: 

A) (U) Wire communications, which include conventional telephone communications or other 
means of transmitting the human voice through cable, wire, radio frequency (RF), voice over 
Internet Protocol (VoIP), or other similar connections; 

B) (U) Otrtl communications, typically intercepted through the use of devices that monitor and 
record oral conversations (e.g., a body transmitter or recorder or a fixed location transmitter or 
recorder used during face-to-face communications in which a person would have a reasonable 
expectation of privacy but for the consent of the other party); and 

C) (U) Electronic communications, which include any transfer of signs, signals, writing, images, 
sounds, data, or intelligence by a wire, radio, electronic, or optical system or network (e.g., e- 
mail, instant message, chat sessions, text messaging, non-voice peer-to-peer communications), 
as that term is defined in 18 U.S.C. § 25 10(12)(14) and (17), which are intercepted and 
recorded at the time of transmission. The monitoring of electronic communications based on 
one party consent is sometimes referred to as "consensual computer monitoring." “Consensual 
computer monitoring” applies to “real time” electronic surveillance based on consent and does 
not include retrieving or obtaining records of communications that have been stored on the 
computer or elsewhere after the communication has occurred. 

(U) Note regarding electronic communication monitoring : Agents seeking to 
consensually monitor electronic communications (specifically, communications to, 
through, or from a computer) must consider whether the party who has consented is a 
party to all of the communications they want to monitor or whether some of the 
communications involve a computer trespasser, as defined by the computer trespasser 
exception. (See DIOG Section 18.6.2) The trespasser exception and the consensual 
monitoring of communications exceptions are related, but separate, exceptions to the 
Wiretap Statute. The owner, operator, and authorized users of a protected computer or 
computer network can consent to the monitoring of only those communications they send 
or receive (i.e., to which they are a party), which typically does not include a trespasser's 
communications. The trespasser exception allows the interception of the communications 
transmitted to or from the trespasser. 

(U) When applicable, the exceptions to the Wiretap Statute can be used together, 
permitting the interception of the communications of both authorized users and 


Version Dated: 
October 15, 2011 


18-50 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 



UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide ' § 1 8 

trespassers on the protected computer. This is particularly useful when it is difficult to 
discern the trespasser communications from other communications. If it is possible to 
obtain consent to monitor the communications of the authorized users, use of both the 
consent and trespasser exceptions together can mitigate the risk of over or under 
collection of the trespasser's communications. 

18.6.1.5 (U) Standards and Approval Requirements for Consensual Monitoring 

18 . 6 . 1 . 5.1 (U) General Approval Requirements 

(U//FOUO) Except as provided below, an SSA may approve the consensual monitoring of 
communications if the information likely to be obtained is relevant to an ongoing Predicated 
Investigation. SSA approval, documented through the FD-759, is conditioned on the 
following criteria being met and documented on the FD-759 and other supporting 
documentation: 

. 18.6.1.5.1.1 (U) Reasons for Monitoring 

(U//FOUO) The synopsis must include sufficient factual information supporting the need 
for the monitoring. It must provide the relationship between the monitoring and the 
investigative purpose (e.g., obtain evidence of drug trafficking, public corruption, etc.). 

18.6.1.5.1.2 (U) Documented Consent of a Party to the Communication to 
be Monitored 

(U//FOUO) Consent must be obtained from one of the parties to be monitored, and the 
consent must be documented to the appropriate investigative ELSUR sub-file. Having the 
consent of one of the parties provides an exception to the Title III statute. The 
requirement to obtain and document consent also applies to the monitoring of computer 
communications. See DIOG Section 18.6.1.8 for specific procedures. 

18.6.1.5.1.3 (U) Subject 

(U//FOUO) Agents conducting consensual monitoring must not intentionally intercept 
third-parties who are not of interest to the investigation except for unavoidable or 
inadvertent overhears. 

18.6.1.5.1.4 (U) Location of device 

(U//FOUO) Consensual monitoring can only be approved if appropriate safeguards are in 
place to ensure that the consenting party remains a party to the communication 
throughout the course of monitoring. For example, if a fixed-location monitoring device 
is being used, the consenting party must be admonished and agree to be present during 
the duration of the monitoring. If practicable, technical means must be used to activate 
monitoring only when the consenting party is present. 
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18.6.1.5.1.5 (U) Notice of Consensual Monitoring to otherField Offices 

(U//FOUO) If an employee, CHS, or non-confidential third party is operationally tasked 
to conduct consensual monitoring outside the field office’s territory, the FBI employee 
requesting approval to conduct the monitoring must provide notice to the SSA who is 
responsible for the investigative program in the field office where the moni toring will 
occur. This notice must be documented in the appropriate investigative file] 


(U//FOUOf 


18.6.1.5.1.6 (U) Duration of Approval 

(U//FOUO) The request for approval must state the length of time needed for monitoring. 
Unless otherwise warranted, approval may be granted for the duration of the 
investigation, subject to a substantial change of circumstances. If one or more sensitive 
monitoring circumstances is present, DOJ may limit its approval to a shorter duration. 

See DIOG Section 18.6.1.6.3 below. 

18.6.1.5.1.7 (U) Legal Review 

(U//FOUO) Prior to the opening of consensual monitoring, the CDC or OGC must concur 
that, given the facts of the investigation, the consensual monitoring is legal. Although 
AUSA concurrence is no longer required for consensual monitoring, providing notice to 
the AUSA is encouraged. 

18.6.1.5.1.8 (U) Change of Monitoring Circumstances 

(U//FOUO) Whenever the monitoring circumstances change substantially, a new FD-759 
must be executed, and the CDC or OGC must be recontacted to obtain new concurrence. 
(AGG-Dom, Part V.A.4.) The following are examples of substantial changes in 
monitoring circumstances which require a new FD-759: a different consenting party, a 
change in the location of a fixed monitoring device, or the addition of a new computer 
system. If any of these or other monitoring circumstances substantially change, the FBI 
employee must immediately contact the CDC or OGC. 

1 8.6. 1 .5. 1 .9 (U) Joint Investigations 

(U//FOUO) In joint investigations, the policy and procedures for conducting any 
investigative method or investigative activity by employees or CHSs are usually 
governed by FBI policy. Similarly, employees from other agencies who are participating 


b7E 
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in a joint investigation with the FBI are generally governed by their agencies’ policies 
regarding approvals. If, however, the FBI has assumed supervision and oversight of 
another agency’s employee (e.g., a full time JTTF Task Force Officer), then FBI policy 
regarding investigative methods or investigative activity controls. Similarly, if another 
agency has assumed supervision and oversight of a FBI employee, unless otherwise 
delineated by MOU, the other agency’s policy regarding investigative methods or 
investigative activity controls. 

(U//FOUO) Consensual monitoring conducted by a non-confidential party (e.g., witness, 
victim, etc.) will be controlled by the agency that is primarily responsible for the non- 
confidential party. In a joint investigation, the employees should reach an understanding 
as to which agency is responsible for the non-confidential party; that agency’s policies 
will govern approval and documentation requirements for consensual monitoring. 

18.6.1.6 (U) Consensual Monitoring Situations Requiring Additional Approval 

18.6.1.6.1 (U) Party Located Outside the United States 

(U//FOUO] 


(U//FOUO)r 


(U//FOUO)[ 
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(U//FOUO)[ 


| See DIOG Section 13. 

18 . 6 . 1 . 6.2 (U) Consent of More than One Party Required for Consensual Monitoring 


(U//FOUO) For those state, local and tribal governm ents that require all-partv consent and do 
not sanction or provide a law enforcement exception! I 


(U//FOUO) The law of the state or territory where the monitoring will take place will govern 
whether OIA approval is needed. 

(U//FOUO) Consensual monitoring authority and OIA in all-party consent states with no law 
enforcement exception for FBI employees ancj 

and the authorization must be 

appropriately documented. As noted in DIOG Section 17.5 above, OIA authority for a CHS 
must be approved in conformity with the AGG-CHS and the FBI CHSPG. 

(U//FOUO] | 


(U//FOUO)[ 
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(U) Requests to monitor communications when a sensitive monitoring circumstance is 
involved must be approved by the DOJ Criminal Division, or, if the investigation concerns a 
threat to the national security or foreign intelligence collection, by the DOJ NSD. (AGG- 
Dom, Part V.A.4) A “sensitive monitoring circumstance” is defined in the AGG-Dom, Part 
VII.O, to include the following: 

A) (U) Investigation of a member of Congress, a federal judge, a member of the Executive 
Branch at Executive Level IV or above, or a person who has served in such capacity within 
the previous two years (Executive Levels I through IV are defined in 5 U.S.C. §§ 53 12-5315); 

B) (U) Investigation of the Governor, Lieutenant Governor, or Attorney General of any state or 
territory, or a judge or justice of the highest court of any state or territory, concerning an 
offense involving bribery, conflict of interest, or extortion related to the performance of 
official duties; 

C) (U) The Attorney General, the Deputy Attorney General, or an Assistant Attorney General has 
requested that the FBI obtain prior approval for the use of consensual monitoring in a specific 
investigation; or 

D) (U) A party to the communication is in the custody of the Bureau of Prisons (BOP) or the 
United States Marshal Service (USMS) or is being or has been afforded protection in the 
Witness Security Program. 
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E) (U//FOUO' 


F) (U//FOUO) See the classified provisions in DIOG Appendix G for additional information 
regarding consensual monitoring. 

1 8.6. 1 .6.3.1 (U//FOUO) PROCEDURE FOR OBTAINING DOJ APPROVAL FOR A 

Sensitive Monitoring Circumstance: 



18.6.1 .6.3 .2 (U//FOUO) EMERGENCY REQUESTS INVOLVING SENSITIVE 


Monitoring Circumstances: 
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18.6.1.7 (U) Duration of Approval 

(U//FOUQ1I 


18.6.1.8 (U) Specific Procedures 

(U//FOUO) The following procedures apply when obtaining consent. 
18.6.1.8.1 (U) Documenting Consent to Monitor/Record 

OJ//FOUQ1 
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1 8.6. 1 .8. 1 . 1 (U) Consensual Monitoring of Computers 


(U//FOUO) 


| the CPC or OGC must review the document at issue to ensure that the implied 
consent is legally sufficient. 

18.6.1.8.2 (U) Documenting Approval 

(TJ//FOIJOtl 


18.6.1.8.3 (U) Retention of Consensually Monitored Communications 

(U//FOUOj 


18.6.1.8.4 (U) Multiple Communications 


(U//FOUOj 


18.6.1.8.5 (U) Investigation Specific Approval 

(U//FOUO)! 


18.6. 1.9 (U) Compliance and Monitoring 

(U//FOUO) Case agents and supervisors must regularly monitor the use of this method to 
ensure that the continued interception of communications is warranted and lawfully obtained 
by virtue of consent, express or implied, from a party to the communication. Such monitoring 
shall include a review of the investigative file to ensure that consent and authorization forms 
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are in the appropriate investigative ELSUR sub-file and properly completed by the requesting 
agent. ELSUR program personnel must review all submitted FD-759s and consent forms (FD- 
472 and FD- 1071) to ensure proper approval is documented for the consensual monitoring of 
communications 

18.6.1.10 (U) Evidence Handling 

(u//Fouq 
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18.6.2 (U) Investigative Method: Intercepting the Communications of a 

Computer Trespasser 

18.6.2.1 (U) Summary 

(U) The wire or electronic communications of a computer trespasser to, from, or through a 
protected computer may be intercepted and collected during a Predicated Investigation. Use of 
this method requires SSA approval and review by the CDC or the OGC. (AGG-Dom, Part 
V.A.4) 


18.6.2.2 (U) Application 

fuy/Fouoi i b7E 


18.6.2.3 (U) Legal Authority 

A) (U) The Fourth Amendment to the United States Constitution and case law interpreting the 
same; 

B) (U) The Wiretap Statute, 18 U.S.C. § 251 1, prohibits the intentional interception and use of 
wire, oral, or electronic communications absent an exception; 

C) (U) Computer Trespasser Exception, 18 U.S.C. § 251 l(2)(i); and 

D) (U) The Foreign Intelligence Surveillance Act of 1978 (FISA), 50 U.S.C. §§ 1801 et seq., 
requires court authorization for “electronic surveillance.” FISA specifically provides, 
however, that the acquisition of computer trespasser communications that would be 
permissible under 18 U.S.C. § 251 l(2)(i) are not subject to the FISA court order requirement 
for electronic surveillance of wire communication under section 101(f)(2) of FISA. 50 U.S.C. 

§ 1801(f)(2). 

18.6.2 .4 (U) Definition of the Communications of a Computer Trespasser 

(U) Generally, the Wiretap Statute (also referred to as Title III), 18 U.S.C. §§ 2510-2522, 
prohibits the intentional interception of wire, oral, or electronic communications unless one of 
several exceptions applies. One such exception is the interception of a computer trespasser's 
wire or electronic communications to, through or from a protected computer based on the 
authorization of the owner or operator of that computer. Another statutory exception is based 
on the consent of a party to the communication. This section relates specifically to the 
computer trespasser exception; the policy on consensual recording of computer 
communications can be found at DIOG Section 18.6.1. 

(U) The computer trespasser exception to the Wiretap Statute, 18 U.S.C. § 25 1 1 (2)(i), permits 
a person acting under color of law to intercept the wire or electronic communications of a 
computer trespasser that are transmitted to, through, or from a protected computer when the 
owner or operator of that computer authorizes the interception. The use of this method does 
not include retrieving or obtaining records of communications that have been stored on the 
computer or elsewhere after the communication has occurred. 
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(U) The statute requires: 

A) (U) The owner or operator of the protected computer to authorize the interception of the 
trespasser’s communications on the protected computer; 

B) (U) The person acting under color of law to be engaged in a lawful investigation; 

C) (U) The person acting under color of law to have reasonable grounds to believe that the 
contents of the trespasser’s communications will be relevant to the investigation; and 

D) (U) The interception is limited to the communications transmitted to or from the trespasser. 

(U) The case agent is responsible for documenting the basis for the conclusion that the person 
who provided authorization to intercept the trespasser’s communications is either the owner 
or operator of the protected computer. The “owner or operator” must have sufficient authority 
over the protected computer/computer network system to authorize access across the entire 
system. This could be a corporate officer, CIO, or system administrator, if the system 
administrator has authority across the entire system. In any instance in which the 
identification of the owner or operator is not plainly evident, the case agent must seek the 
assistance of the CDC or the OGC to identify the proper owner or operator. 

(U) A "protected computer," defined in 18 U.S.C. § 1030(e), has been generally interpreted to 
be any computer or computer network device connected to the Internet, although it also 
includes most computers used by a financial institution or the United States Government 
regardless of whether the computer is connected to the Internet. 

(U) A “computer trespasser” is a person who accesses a protected computer without 
authorization and thus has no reasonable expectation of privacy in any communication 
transmitted to, from, or through the protected computer. The definition of computer trespasser 
does not include a person known by the owner or operator to have exceeded their authority or 
to have an existing contractual relationship with the owner or operator for access to all or part 
of the computer. (18 U.S.C. § 2510(21)) 

(U) The trespasser exception and the consensual monitoring of communications exception are 
related, but separate, exceptions to the Wiretap Statute. The owner, operator, and authorized 
users of a protected computer can consent to the monitoring of only those communications 
they send or receive (i.e., communications to which they are a party), which do not include a 
trespasser's communications. (See DIOG Section 18.6.1) In comparison, under the trespasser 
exception, the owner or operator may only authorize the interception of the communications 
of a trespasser transmitted to, through or from the protected computer. 

(U) When applicable, the computer trespasser and consensual monitoring of communications 
exceptions to the Wiretap Statute can be used together, permitting the interception of 
communications of both authorized users and trespassers on the protected computer. This is 
particularly useful when it is difficult to discern the trespasser communications from other 
communications. If it is possible to obtain consent to monitor the communications of the 
authorized users, using the consent and trespasser exceptions together can mitigate the risk of 
over or under collection of the trespasser's communications. See DIOG Section 18.6.1 for the 
policy regarding consensual monitoring of computer communications. 
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18.6.2.5 (U//FOUO) Use and Approval Requirements for Intercepting the 

Communications of a Computer Trespasser 

18.6.2.5.1 (U) General Approval Requirements 

(U//FOUO) An SSA may approve the use of the computer trespasser exception, subject to 
CDC or OGC review. Approval is conditioned on the following criteria being met and 
documented on the FD-759 and through other supporting documentation in the investigative 
file: 

1 8.6.2.5.1 . 1 (U) Reasons for the Interception 

(U//FOUO) The synopsis portion of the FD-759 must include sufficient facts to support 
the need for the interception and to explain how the contents of the trespasser's 
communications will be relevant to the investigative purpose. 

1 8.6.2.5.1 .2 (U) Owner or Operator Authorization 

(U//FOUO) The authorization of the owner or operator of the protected computer (who 
may be the system administrator, as stated above) to a person acting under color of law to 
intercept the trespasser communications on the protected computer system or network 
must be documented using the FD-1070, Authorization to Intercept the Communications 
of a Computer Trespasser. The steps the case agent takes to ensure that the person 
providing the authorization is the actual or appropriate owner or operator of the protected 
computer must be documented in the investigative file. See 18.6.2.6 below for specific 
procedures. 

18.6.2.5.1.3 (U) Acquiring only Trespasser Communications 

(U//FOUO) When intercepting communications under the computer trespasser exception 
alone (i.e., not in conjunction with consensual monitoring of electronic communications), 
the collection must not intentionally acquire communications other than those to or from 
the trespasser. This can often be technically complicated to accomplish depending on the 
use and configuration of the protected computer and the sophistication of the trespasser. 
The steps to be taken to identify trespasser communications and to isolate such 
communications from those of authorized users must be considered by the approving and 
reviewing officials and documented in the investigative file. See DIOG Section 18.6.2.6 
below for specific procedures. 

18.6.2.5.1.4 (U) Owner or Operator Collection 

(U//FOUO) The interception of trespasser communications may be conducted by the FBI 
or by the owner or operator of the protected computer at the FBI’s request. In either 
instance, the interception is being conducted under color of law. If the collection is not 
being conducted by the FBI, the case agent must document that he or she has informed 
the person conducting the interception that it must be accomplished in conformity with 
the statute. 
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1 8.6.2.5.1 .5 (U) Location of Intercept 

(U//FOUO) If the intercept or collection of the trespasser communications will occur 
outside of the field office of the approving official, the SAC or AS AC of the field office 
within which the interception will occur must be notified, and the notification must be 
documented in the investigative file. 

18.6.2.5.1.6 (U) Duration 

(U//FOUO) The request for approval (FD-759) must state the length of time needed for 
the interception. Unless otherwise warranted, approval may be granted for the duration of 
the investigation, subject to a substantial change of circumstances, as described in DIOG 
Section 18.6.2.6, below. 

18.6.2.5.1.7 (U) Legal Review 

(U//FOUO) Prior to the opening of the interception, the CDC or OGC must concur that, 
given the facts of the investigation, the interception appears to be lawful under the 
computer trespasser exception. Whenever the factors surrounding the use of the approved 
technique change substantially, a new FD-759 must be executed. The newly executed 
FD-759 must include refreshed concurrence of the CDC or OGC. (AGG-Dom, Part 
V.A.4.) The following are examples of substantial changes in the circumstances of the 
interception that require a new FD-759: a change in owner or operator, a change in the 
method of collection, or the change or addition of a protected computer system. On the 
other hand, technical changes in the collection system for the purpose of improving or 
refining the interception are usually not substantial changes to the circumstances of the 
interception. 

18.6.2.5.1 .8 (U) Joint Investigations 

(U//FOUO) In joint investigations, if the FBI is the lead investigating agency, FBI 
policies and guidance regarding the interception of computer trespasser communications 
must be followed. If the FBI is not the lead investigating agency, the policies of the lead 
investigating agency must be followed and documented to the appropriate FBI 
investigative file. 

1 8.6.2.5.1 .9 (U) Extraterritorial Considerations 
(U//FOUQ1 
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18.6.2.6 (U) Duration of Approval for Intercepting the Communications of a 
Computer Trespasser 

(U//FOUO) The interception and collection of computer trespasser communications under the 
computer trespasser exception may be approved for a specified length of time or for the 
duration of the particular investigation. 

18.6.2.7 (U) Specific Procedures for Intercepting the Communications of a 
Computer Trespasser 

(U//FOUO) The following procedures apply when obtaining authorization. 

1 8. 6.2. 7.1 (U) Documenting A uthoriza tion to Intercept 

(U//FOUO) Whenever possible, written authorization must be obtained from the owner or 
operator of the protected computer and documented on an FD-1070, Authorization to 
Intercept the Communications of a Computer Trespasser. 

(U//FOUO) If the authorization from the owner or operator is provided orally, at least one FBI 
agent and another law enforcement or intelligence officer should witness the authorization, 
and the authorization must be memorialized in an FD-302. The fact that the authorizing party 
has declined or was unable to give written authorization must also be recorded on the FD- 
1070, Authorization to Intercept the Communications of a Computer Trespasser form. This 
form should then be executed in all respects with the exception of the authorizing party's 
signature. 

(U//FOUO) The case agent must document to the file (i.e., FD-302 or EC) the facts that 
establish that the person providing the authorization is a proper party to provide authorization 
for the anticipated interception. 

(U//FOUO) If the case agent is seeking approval for the FBI to engage in both consensual 
monitoring and an interception of the computer trespasser on the same computer system, 
separate forms — | 


18.6.2. 7.2 (U) Acquiring Only the Trespasser Communications 

(U//FOUO) The computer trespasser exception permits the FBI to intercept only trespasser 
communications. Prior to seeking approval to intercept computer trespasser communications, 
the case agent must coordinate the use of the method with the Field Office Technical Advisor 
by submission of an Electronic Technical Request (ETR). On receipt of the ETR, the 
Technical Advisor must ensure that the technical equipment and expertise necessary to 
lawfully implement the interception are timely provided following approval to use this 
investigative method. 

(U//FOUO) Many of the technical challenges and risks associated with accurately isolating 
the trespasser communications can be mitigated by also obtaining consent to monitor the 
computer or a court order. The possibility of using the authority to intercept trespasser 
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communications in conjunction with consent should be raised at the time of the ETR 
submission or as soon thereafter as the case agent determines that the authorized users of the 
protected computer will consent to FBI monitoring. 

(U//FOUO) When intercepting trespasser communications, the case agent must prepare an 
FD-302 or EC detailing the steps taken to identify trespasser communications and to isolate 
such communications from those of authorized users. For example: "reviewed system logs 
provided by the system administrator and identified a trespasser accessing the system at the 
following dates and times via IP address xxx or port xxx." Additionally, any subsequent 
review or revision of the steps needed to identify and isolate the trespasser's communications 
must also be documented to the investigative file by an EC or FD-302, as appropriate. 

1 8. 6.2. 7.3 (U) Reviewing the Accuracy of the Interception 

(U//FOUO) At the opening of interception and collection of computer trespasser 
communications, the Technical Advisor or designated technically trained agent (TTA) 
coordinating the implementation of the interception and collection device shall ensure that 
appropriate collection parameters are implemented as required by OTD policy and 
procedures. 

(U//FOUO) The case agent shall ensure a timely initial review of the collected information to 
verify that the interception and collection are limited to communications authorized for 
interception and collection under the trespass authority or other lawful exception. Following 
this initial review, the case agent shall ensure that a similar review and evaluation is repeated 
at appropriate intervals throughout the duration of the interception to ensure that the 
interception and collection remain within the scope of the trespasser or other lawful 
exceptions. Factors that may impact the frequency of reviews include, but are not limited to: 
volume of data to be reviewed, complexity and nature of data collected, and complexity of the 
trespassed system. 

(U//FOUO) Any FBI employee who identifies interception and collection of communications 
that may be outside the scope of the trespasser or other lawful exception shall immediately 
notify the case agent and the operational SSA of the possible unauthorized interception and 
collection of communications. Upon the determination that communications have been 
unlawfully intercepted or collected, the interceptions and collection must be halted 
immediately. The case agent must consult with a TTA to determine whether collection may be 
resumed in a manner that assures further unlawful collections will not occur. If the SSA 
determines that unlawful collection can be reliably prevented, that determination must be 
documented to the file before lawful interceptions and collection may resume. 

(U//FOUO) The content of communications determined to have been unlawfully collected 
cannot be used in any manner and shall be removed promptly from all FBI systems and 
destroyed. A memorandum documenting the removal and destruction shall be filed in the 
main investigation file and the appropriate investigative ELSUR sub-file. 
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18.6.2.7.4 (U) Reviewing the Relevancy of the Interception 

(U//FOUO) The trespasser exception requires the FBI to have a reasonable belief that the 
contents of the trespasser’s communications will be relevant to the investigation. Following 
opening of the interception and collection of the trespasser communication, the case agent 
must ensure that the collected communications are reviewed, at appropriate intervals 
throughout the duration of the interception, to determine whether the interception is and 
continues to be relevant to the authorized investigation. Factors that may impact the frequency 
of reviews include, but are not limited to: volume of data to be reviewed, complexity and 
nature of data collected, and complexity of the trespassed system. 

18. 6.2. 7.5 (U) Duration of Approval 

(U//FOUO) Authorization to intercept trespasser communications remains valid until such 
time as the authorizing party, orally or in writing, revokes the authorization or on the 
termination date of the authorization, whichever comes first. 

1 8. 6.2. 7. 6 (U) ELSUR Requirements 

(U//FOUO) The information obtained from the collection must be retained in conformity with 
the ELSUR Policies located in the OGC Main Law Library) or other applicable policies. 

(U//FOUO) All ELSUR downloading, processing, and handling of original, derivative, and 
copies of original or derivative ELSUR evidence must be conducted by an ELSUR operations 
technician (EOT) or other designated employee (e.g. an agent who has successfully completed 
ELSUR t raining in Virtual Academy). ELSUR evidence must not be uploaded into 
fU) Multiple Communications 

(U//FOUO) In investigations in which various modes of communication may be intercepted 
(e.g., telephonic, non-telephonic, electronic communications, etc., or the use of consensual 
computer monitoring in conjunction with the interception of trespasser communications), one 
FD-759 may be used to document approval, provided that each mode of communication to be 
monitored is being used in the same investigative file and all facts required on the FD-759 are 
the same. If the material facts on the FD-759 vary (e.g., different periods of authority, etc.), 
separate FD-759s must be executed. 

1 8. 6.2. 7. 7 (U) INVESTIGA TION SPECIFIC APPROVAL 

(U//FOUO) Approval for intercepting a computer trespasser's communications is 
investigation specific and is not transferable to any other investigation, unless the 
investigative file under which the authority was granted is consolidated or reclassified. 
Investigation specific approval must be obtained for any spin-off investigation(s) that arises 
out of the original investigation. 

18.6.2 .8 (U) Compliance and Monitoring 

(U//FOUO) Case agents must regularly monitor the use of this method to ensure that the 
continued interception of trespasser communications is warranted and being lawfully 
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conducted. Such monitoring shall include a review of the investigative file to ensure that 
consent and authorization forms have been properly executed and filed. ELSUR program 
personnel must review all submitted FD-759s and FD-1070 (Authorization to Intercept the 
Communications of a Computer Trespasser form) to ensure proper approval has been 
documented for the interception of computer trespasser communications. 

18.6.2 .9 (U) Evidence Handling 

(U//FOUO) All ELSUR downloading, processing, and handling of original, derivative, and 
copies of original or derivative ELSUR evidence must be conducted by an ELSUR operations 
technician (EOT) or other designated employee (e.g. an agent who has successfull y completed 
ELSUR training in Virtual Academy). ELSUR evidence must not be uploaded intq 
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18.6.3 (U) Investigative Method: Closed-Circuit Television/Video 

Surveillance, Direction Finders, and other Monitoring Devices 

18.6.3.1 (U) Summary 

(UZ/FOUQ^f 



fu//Fouof 


18.6.3.2 (U) Application 

(U//FOUO)! 


b7E 


b7E 
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not otherwis e prohibited by AGG-Dom, Part III.B.2-3 


18.6.3.3 (U) Legal Authority 

A) (U) AGG-Dom, PartV 

B) (U) Rule 41 Federal Rules of Criminal Procedure 

C) (U) Fourth Amendment to the United States Constitution 

18.6.3.4 (U) Definition of Investigative Method 

A) (UZZFOUO) Closed Circuit Television/Video Surveillance (CCTV/Video Surveillance): a 
fixed-location video camera/device that is typically concealed from view or that is placed on 
or operated by a consenting party. 

B) (U//FOUO) Electronic Tracking Devices: See OGC guidance on the use of this method here . 
See also the OTD Technology-based Tagging, Tracking and Locating Program PG. 

18.6.3.5 (U//FOUO) Standards for Use and Approval Requirements for 
Investigative Method 

(U//FOUO) When a video camera is physically operated as a hand-held video and is used in 
an area in which no one has a reasonable expectation of privacy, its use is equivalent to using 
a still camera and does not require CDC review or SSA approval. 
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(U//FOUO) Except for a hand-held video as described above, CDC or OGC review and SSA 
approval is required for the use of CCTV/Video Surveillance. CDC review and SSA approval 
must be documented using the FD-759. SSA approval may be granted if the following criteria 
have been met: 


A) (U//FOUO) Legal review and concurrence from the CDC or OGC that a court order is not 
required for installation or use of the device because there has been lawful consent, no 
reasonable expectation of privacy exists, or no physical trespass is necessary to install the 
device. Whenever circumstances change in either installation or monitoring, a new legal 
review must be obtained to determine whether a separate authorization is necessary; 


B) (U//FOUO) 

C) (U//FOUO; 


Use of the method is 


reasonably likely to achieve investigative objectives; 


18.6.3.6 (U) Duration of Approval 

(U//FOUO)! 


18.6.3.7 (U) Specific Procedures 

(U//FOUO) To use this method, the case agent must: 


A ) (U//FOUOf 


B) (U//FOUO; 



D) fU//FOUOf 
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18.6.3.8 (U) CCTV/Video Surveillance where there is a Reasonable Expectation of 

Privacy in the area to be viewed or for the installation of the equipment. 

18.6.3.8.1 (U) Warrantor Court Order 

(U//FOUO) A warrant/court order is required for the use of CCTV/Video Surveillance when a 
reasonable expectation of privacy exists in either the area to be viewed or the location where 
the equipment will be installed, unless the installation and monitoring is being conducted 
pursuant to consent. See DIOG Section 18.6.3.8.2 below for the required consultation with the 
Technical Advisor (TA) or technically Trained Agent (TTA). 

A) (U//FOUO) Criminal Investigations : When there is a reasonable expectation of privacy in the 
area to be viewed and no consenting party, prior DOJ/OEO approval is required before 
seeking a warrant/order. When there is a reasonable expectation of privacy only in the location 
where the CCTV/Video Surveillance equipment will be installed, but not in the area to be 
viewed, prior DOJ/OEO authorization is not required to seek a warrant/order for the 
installation. In an emergency situation where CCTV usage is desired and a warrant/court order 
would be required, but cannot be obtained within the time required, an AUSA must be 
contacted to seek DOJ/OEO’s guidance on how to proceed. 

B) (U//FOUO) National Security Investigations : The use of CCTV/Video Surveillance in 
national security investigations under the Foreign Intelligence Surveillance Act of 1978 
(FISA) requires the filing of an appropriate FISA court order because the use of CCTV/Video 
Surveillance falls within the definition of “electronic surveillance” under FISA. See DIOG 
Section 18.7.3. 

C) (U//FOUO) Where a warrant is required and the request is include d with a Title III or is a 
FISA request : Where the CCTV/video surveillance request is made pursuant to FISA or in 
conjunction with a Title III request, the required supervisory approvals and CDC or OGC 
review will take place as part of the larger FISA or Title III review and approval process. No 
additional reviews or approvals for the CCTV/video surveillance are required. 

D) (U//FOUO~) Where a warrant is required and the, request is NOT coupled with a Title UI 
request or made pursuant to FISA : As the FD-759 is not used when a court order is needed, 
the required SSA approval and CDC or OGC review must be documented in an EC. Maintain 
the original SAC approved EC in the appropriate investigative ELSUR sub-file. 

18.6.3.8.2 (U//FOUO) Required Consultation with Technical Advisor (TA) or 
Technically Trained Agent (TTA ) 

(U//FOUO) Prior to filing an application and affidavit for a warrant/court order under Rule 
41/All Writs Act (in criminal law-based investigations) or under FISA (in national security- 
based investigations), the case agent/special agent must consult with the field office TA/TTA 
to: 


A) (U//FOUO) consider any potential technical issues; and 

B) (U//FOUO) review any “technical” or “technique” language used in the application and 
affidavit. 

(U//FOUO) This review ensures that the language used therein is accurate and does not 
disclose classified/sensitive methods and techniques. 
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18.6.3.9 (U) Evidence Handling 

(U//FOUO) All ELSUR downloading, processing, and handling of original, derivative, and 
copies of original or derivative ELSUR evidence must be conducted by an ELSUR operations 
technician (EOT) or other designated employee (e.g. an agent who has successfull y completed 
ELSUR training in Virtual Academy). ELSUR evidence must not be uploaded into | | 

18.6.3.10 (U) CCTV/VlDEO SURVEILLANCE EQUIPMENT - TYPES, AVAILABILITY, REPAIR AND 
Disposal 

18.6.3.10.1 (U) Equipment Types 


(U//FOUO) Listed below are categories of CCTV/Video Surveillance equipment and related 
methods. Since CCTV/Video Surveillance tools change with some frequency, available 
equipment and methods can be accessed via the appropriate hyperlink to the VSU Web page. 

A) (U//FOUO) | 

(U) See VSU Web page . 

B) (U//FOUO) | 

('ll) See VSU Web page . 

C) (U//FOUO ] 

(U) See VSU Web page . 

18.6.3.10.1.1 (U//FOUO) r 


(U//FOUO; 


is an approved, unclassified system that sup ports FBI special 
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18.6.3.10.2 (U) Equipment Availability 

(U//FOUO) If CCTV/Video Surveillance equipment is not available from the existing 
field office inventory, the TA/TTA must use the Technical Management Database (TMD) 
to forward requests to the appropriate VSU program manager (PM). 

18.6.3.10.2.1 (U) Survey Sheet 


(U//FOUO) The TA or TTA should contact the case agent/special agent requesting the 
CCTV/video surveillance to det ermine his/her object ive and expectations of the 


]is designed to capture the 


CCTV/Video Surveillance. The 
information needed to maximize investigative and technical success when using 
CCTV/Video Surveillance equipment. 
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18.6.3.10.3 (U) Equipment Repair 

(U//FOUO) Field office TAs/TTAs must consult with the appropriate VSU PM and obtain 
approval prior to sending any CCTV/Video Surveillance equipment to VSU for repairs. 

18.6.3.10.4 (U) Equipment Disposal 

(U//FOUO) Field office TAs/TTAs must determine the appropriate disposition of non-repairable 
equipment. Surplus property will be disposed of by field offices for equipment under its cost 
code. 


18.6.3.11 (U) Compliance and Monitoring 

(U//FOUO) Authorization documents regarding the use of the CCTV/Video must be 
documented in the appropriate investigative ELSUR sub-file and will be available for 
compliance and monitoring review. See this Section and DIOG Section 18.6.1.9 (consensual 
CCTV/video surveillance use) for the requirements for using CCTV/Video Surveillance. 
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(U) Investigative Method: Administrative Subpoenas (compulsory 
process) 


18.6.4.1 (U) Overview of Compulsory Process 



OJ)C 


18.6.4.2 (U) Application 

(U//FOUOII 


b7E 


b7E 
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18.6.4.3 (U) Administrative Subpoenas 

18 . 6 . 4 . 3.1 (U) Summary 

(U) The Attorney General has the authority to issue administrative subpoenas pursuant to two 
provisions of the United States Code, 21 U.S.C. § 876 and 18 U.S.C. § 3486. The FBI has no 
inherent authority to issue administrative subpoenas but has delegated authority from the 
Attorney General to do so. The use of administrative subpoenas is limited to three categories 
of investigations — drug program investigations, child sexual exploitation and abuse 
investigations, and health care fraud investigations — and may not be used for any other 
purpose. The delegated authority varies depending on the federal violation being investigated. 

The type of information that can be obtained using an administrative subpoena is also limited 
by law and by policy of the Attorney General. 

(U//FOUO) Within the FBI, the authority to issue administrative subpoenas is limited to 
positions authorized by the Attorney General: that authority may not be further redelegated. 
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18 . 6 . 4 . 3.2 (U) Legal Authority and Delegation 

1 8.6.43.2. 1 (U) Investigations involving the sale, transfer, manufacture 

OR IMPORTATION OF UNLAWFUL DRUGS 

(U) Authority : 21 U.S.C. § 876 and DOJ Regulation at 28 C.F.R. App to Pt. 0,. Subpt. R § 
4. 

(U) May be issued to : Any individual or business holding records relevant to the drug 
investigation. 

(U) Records to be obtained : Any records relevant or material to the investigation. 

(U//FOUO) Delegated authority to issue : By DOJ regulation, the Attorney General’s 
delegation includes SACs, ASACs, SSRAs and “those FBI Special Agent Squad 
Supervisors who have management responsibilities over Organized Crime/Drug Program 
investigations.” 

(U//FOUO) Multi-offense investigations.] 


(U//FOUO) Confidentiality \ I 


1 8.6.43 .2.2 (U) Investigations involving the sexual exploitation or abuse 

OF CHILDREN 

(U) Authority : 18 U.S.C. § 3486(a) and Attorney General Order 3220-2010. 

(U) May be issued to : A “provider of an electronic communication service” or a “remote 
computer service” (both terms defined below in DIOG Section 18.6.4.3.4.2.1) and only 
for the production of basic subscriber or customer information. The subpoena may 
require production as soon as possible but in no event less than 24 hours after service of 
the subpoena. 
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(U) Records to be obtained I 


(U//FOUO - ) Delegated authority to issued 


(U//FOUO) Violations to which this authority applies : These administrative subpoenas 
may only be issued in investigations that involve a violation of 18 U.S.C. §§ 1201, 1591, 
2241(c), 2242, 2243, 2251, 2251A, 2252, 2252A, 2260, 2421, 2422, or 2423 in which the 
victim is less than 18 years old. Under the Attorney General’s delegation, an 
administrative subpoena in these investigations may be issued only to “providers of 
electronic communication services” or to “remote computing services” to obtain the 
information listed above. These administrative subpoenas may not be issued to any other 

person or entity or to obtain any other information, including the content of 

communications] I 


18.6.4.3.2.3 (U) Investigations involving Federal Health Care Fraud 

Offenses 

(\D Authority : 18 U.S.C. § 3486(a) 

(U) Records to be obtained; . Records relevant to an investigation relating to a “federal 
health care offense.” Federal health care offense is defined in 18 U.S.C. § 24. 

(U) May he issued^ to : Any public or private entity or individual with records relevant to 
the federal health care offense. (These are referred to in guidance issued by the Attorney 
General as “investigative demands.”) 

(U//FOUO) Delegated authority to issue : The Attorney General has not delegated 
signature authority to the FBI. AG authority is delegated only to personnel within DOJ’s 
Criminal Division and to United States Attorneys, who may redelegate the authority to 
AUSAs. FBI employees must request an AUSA to issue administrative subpoenas in 
health care fraud investigations. 
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(U) Limitations : The Right to Financial Privacy Act (RFPA) limitations described in 
18.6.4.3.4 of this section apply. The provisions in ECPA govern, as discussed in 
18.6.4.3.4 of this section, if the request for records is addressed to a “provider of 
electronic communication service” or a “remote computing service.” The subpoena may 
not require the production of records at a place more than 500 miles from the place the 
subpoena is served. 

OT I 


(U) Restriction on use ofhealth care information against the individual : Pursuant to 1 8 
U.S.C. § 3486, health information about an individual acquired through an authorized 
investigative demand may not be used in, or disclosed to any person for use in, any 
administrative, civil, or criminal action against that individual unless the action or 
investigation arises from and is directly related to receipt ofhealth care, payment for 
health care, or a fraudulent claim related to health care. 

1 8. 6A.3.3 (U) Approval Requirements 


18.6.4.3.3.1 (U) Required form 


A) (U) pn accordance with DIOG subsecti ons 18.6.4 .3 .2.1 and 

18.6.4.3.2,2 above, must be prep ared and issued using the electronu f | Form 

| or the| f or this purpose. The electronic form 


is designed to ensure an£ 


js: (1) issued only in investigations where its 


use is permitted; (2) used to demand information that can be obtained within the applicable 

legal a nd policy limitations; an d (3) approved by an individual with prop er authority. The l I 
| | nust be serialized into th j |in the r elevant 

investigative case from whic h it is issue d. An electronic copy of j |will 

automatically be saved in the 


Hata base when it is serialized. 


B) (U) The[ 


fallows for the generation of an£ 


tor 


any need specified in DIO G subsections 18.6.4.3.2.1 and 18.6.4.3.2.2 above. For 
I I served to participating providers, it also provides the ability to 

receive expedited return s, as well as a means to review and ingest the return information into 
~~ ™jfor storage, processing, and analysis. 

] addressed to an electronic communication service 


C) (U)[ 


provider contains an attachment explaining the meaning of various terms used in the demand 
for information! f 


I 


[issued by the FBI or proposed by the FBI for issuance by a DOJ 


attorney without approval from OGC or the CDC. That approval must be documented to the 
tile. 


18.6.4.3.3.2 (U) Approval authority 


(U//FOUO) Use of an administrative subpoena requires SSA approval. The subpoena may be 
issued by the SSA if that SSA is among those with delegated authority to do so. See DIOG 
Sections 18.6.4.2.2.1 - 18.6.4.2.2.3 above) Otherwise, the subpoena must be forwarded to an 
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individual with the proper delegated authority. Further review and approval may be required 
depending on the delegation. Review by the CDC is appropriate if legal questions arise in 
preparing and issuing the subpoena. 

(U//FOUO)| | b7E 


1 8.6.4.3 .3 .3 (U) Reimbursement for the Production of Toll Records 


A) (U/FOUO) Reimbursement to a telecommunications provider (electronic communications 
service) fo r toll, and other records produced, pursuant to the issuance of ar| | 


is governed by statutory requirements and exceptions to those provisions. Additional 
guidance on toll record reimbursement, specific circumstances that preclude reimbursement, 
and a templa te telecommunications pr ovider res ponse letter, can he found on the H elp link 


within OTD’ 


Jhome pagd 


T 


B) (U//FOUO) An individual designated by proper authority to issue an 

is permitted to sign and issue a “no payment” response letter to a provider upon determination 
that an invoice received from the telecommunications provider falls within the statutory 
exceptions to reimbursement. Consultation with, and review of the letter by, the CDC is 
appropriate if legal questions arise in preparing and issuing the response letter. 


18.6.4.3.4 (U) Limitations on Use of Administrative Subpoenas 


1 8.6.4.3 .4. 1 (U) Financial Privacy Limitations 

18. 6.4.3.4.1.1 (U) Obtaining records from a financial institution 

(U//FOUO) “Financial records” are those records that pertain to a customer’s relationship 
with a financial institution. The term “financial institution” is broadly defined as a bank, 
savings bank, card issuer, industrial loan company, trust company, savings association, 
building and loan or homestead association, credit union, or consumer finance institution, 
located in any state, territory, or the District of Columbia. See 12 U.S.C. § 3401. (Note : 
The scope of the RFPA’s definition of financial institution for this purpose, which limits 
the restrictions the RFPA places on federal law enforcement in using an administrative 
subpoena, is narrower than the definition of financial institution that is used in connection 
with NSLs. For that purpose, the RFPA refers to the broader definition found in the Bank 
Secrecy Act (BSA). Among the entities included in the BSA definition are money 
transmitting businesses, car dealers, travel agencies, and persons involved in real estate 
closings. See 12 U.S.C. § 3414(d) and 31 U.S.C. § 5312 (a) (2) and (c) (1).) When 
seeking financial records from a financial institution, the FBI must send a certificate of 
compliance required by 12 U.S.C. § 3403 to the financial institution. The certificate must 
indicate, among other things, that notice has been provided by the FBI to the individual 
customer whose financial records are to be obtained. The content of the notice is set out 
in 12 U.S.C. § 3405. A court order may be obtained that allows for delayed notice 
pursuant to 12 U.S.C. § 3409. Notice is not required if the administrative subpoena is 
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issued to obtain the financial records of a corporation or for records not pertaining to a 
customer. Notice is also not required if the administrative subpoena seeks only basic 
account information, defined as name, address, type of account, and account number. See 
12 U.S.C. § 3413(g). 

18.6.4.3.4.1.2 (U) Obtaining records from a Credit Bureau 

(U//FOUO) A credit bureau or consumer reporting agency may only provide name, 
address, former addresses, place of employment and former place of employment in 
response to an administrative subpoena. See 15 U.S.C. § 1681f. A credit bureau or 
consumer reporting agency may not release financial information in a credit report or 
consumer report, or the names and locations of financial institutions at which the 
consumer has accounts pursuant to an administrative subpoena. A court order, a grand 
jury subpoena, or, in an appropriate investigation, a national security letter may be used 
to obtain this information. 15 U.S.C. § 1681b. Notice of disclosure will be provided by 
the credit bureau or consumer reporting agency to the consumer if the consumer requests 
this information. 

1 8.6.4.3.4.2 (U) Electronic Communication Privacy Act 

(U//FOUO) The ability to gather subscriber information and the content of electronic 
communications using an administrative subpoena is governed by ECPA. In 
investigations involving the sexual exploitation or abuse of children, only basic 
subscriber or customer information may be obtained with an administrative subpoena 
under the terms of the Attorney General’s delegation, as described above. No content 
information may be obtained. In drug and health care fraud investigations, an 
administrative subpoena may be used to obtain basic subscriber or customer information 
and certain stored communications, under limited circumstances, from entities that 
provide electronic communication services to the public. 

18. 6.4.3.4.2.1 (U) Scope 

(U//FOUO) ECPA applies to two types of entities that provide electronic 
communications to the public. They are: 

A) (U//FOUO) “Electronic Communication Service” is defined as “any service that provides the 
user thereof the ability to send or receive wire or electronic communications.” 1 8 U.S.C. § 
2510(15) 

B) (U//FOUO) “Remote Computing Service” is defined as the “provision to the public of 
computer storage or processing service by means of an electronic communication system.” 18 
U.S.C. §2711(12) 


18.6.4.3.4.2.2 

(U) Subscriber information 

(U//FOUO) 
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A) (U//FOUO]_ 

B) (U//FOUOQ 

C ) (U//FOU O)| 

D) (U//FOUO)[ 

E) (U//FOUO)f 

F) (UZ/FOUPlf 


(U//FOUOf 


(U//FOUO)[ 


18. 6.43.4.2.3 (U) Second generation connection records 

(U//FOUO)| 


18. 6.43.4.2.4 (U) Records or other information pertaining to a subscriber 

(U//FOUOJ 
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18.6.4.3.4.2.5 (U) Content 

(U//FOUO) Content is the actual substance of files stored in an account, including the 
subject line of an e-mail. 

A) (U) Unopened e-mail held in storage for 180 days or less may not be obtained using an 
administrative subpoena. A search warrant is required. 

B) (U) Unopened e-mail that has been held in electronic storage for more than 1 80 days may be 
obtained with an administrative subpoena. (In the Ninth Circuit, the opened e-mail and un- 
opened e-mail must have been in storage for 180 days before it can be obtained with an ■ 
administrative subpoena. See Theofel v. Farev-Jones. 359 F.3d 1066.) The government must 
provide notice to the subscriber or customer prior to obtaining such content. A limited 
exception to the notice requirement is provided in 18 U.S.C. § 2705. 

C) (U) E-mail that has been opened and the content of other electronically stored files held in 
storage by an entity that provides storage services to the public (i.e., a remote computing 
service, as defined in 18 U.S.C. § 271 1), may be obtained using an administrative subpoena 
with notice to the customer or subscriber, unless notice is delayed in accordance with 18 
U.S.C. § 2705. 

D) (U) E-mail that has been opened and the content of other electronically stored files held in 
storage by an entity that does not provide electronic communication services to the public, 
such as that on the internal network of a business, may be obtained using an administrative 
subpoena. Notice to the individual is not required because this demand is not restricted by 
ECPA. 

(U) The FD-1035 administrative subpoena is not configured to obtain e-mail content 
because of developing case law in this area. This information may be obtain using an 
order issued under 18 U.S.C. § 2703(d). See DIOG Section 18.6.8.3 .B. 

1 8.6.4.3 .4.3 (U) Members of the News Media 

(U//FOUO) Approval Requirements : An administrative subpoena directed to a provider 
of electronic communication services or any other entity seeking to obtain local and long 
distance connection records, or records of session times of calls, made by a member of 
the news media may only be issued with the specific approval of the Attorney General. 
Before proposing such a subpoena, an agent should review 28 C.F.R. § 50.10. Requests 
for AG approval must be made by the AUSA involved in the investigation consistent 
with the DOJ policies set forth in 28 C.F.R. § 50.10. Guidance on the DOJ policy may be 
obtained from the Investigative Law Unit and/or the Privacy and Civil Liberties Unit, 
OGC. 


18.6.4.3.5 (U) Compliance/Monitoring 

18.6.4.3.5.1 (U) Limits on use 

(U//FOUO)| 
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18.6.4.3.5.2 (U) Overproduction 


(U//FOUO) If any of the information that is obtained with an administrative subpoena is 
subject to statutory privacy protections (e.g., records subject to the Electronic 
Communications Privacy Act (ECPA), Right to Financial Privacy Act (RFPA), the Fair 
Credit Reporting Act (FCRA), Health Insurance Portability and Accountability Act 
(HEPAA), or the Buckley Amendment), it must be reviewed at the time it is received by 
the employee who requested the issuance of an administrative subpoena to ensure that the 
information received from the third party provider is within the scope of the request. Any 
information received from a third party provider that is beyond the scope of the 
administrative subpoena and is subject to statutory protections must be treated as an 
overproduction. If it is determined that the overproduced material is subject to statutory 
protection, then all of the produced material must be sequestered with the employee’s 
supervisor and may not be serialized into any FBI database or used in the investigation 
until one the following methods of disposition have been completed at the discretion of 
the field office or FBIHQ division that issued the administrative subpoena: 


A) (U) The employee redacts the overproduced material. The employee’s supervisor must 
approve the scope of the redaction. If there is any question whether the information provided 
is within the scope of the administrative subpoena, the CDC or OGC must be consulted. The 
method of redaction is left to the discretion of the employee, but redacted information must 
not be visible, used in the investigation, or serialized into any FBI database. The method of 
redaction will vary depending on whether the information was provided in hard copy or 
electronically. After the overproduced information has been redacted, the remainder of 
properly produced information may be serialized into any database and used in the 
investigation; 



C) (U) The records are returned to the entity that produced them; or 


D) (U) The records are destroyed. 


(U) Whichever disposition is selected for the overproduction, it must be documented in 
the investigative SBP sub-file for administrative subpoenas. 


(U) Any questions concerning this process, including the review or disposition of the 
responsive records, or the statutes which cover such records, should be discussed with the 
CDC or OGC. 
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1 8.6.43 .5 .3 (U) Factors for compliance 

(U//FOUO) The following factors should be considered to ensure compliance with 

applicable laws and regulations that govern the FBFs use of administrative subpoenas: 

A) (U//FOUO) The administrative subpoena must relate to a type of investigation for which the 
subpoena is authorized; 

B) (U//FOUO) The administrative subpoena must be directed to a recipient to whom an 
administrative subpoena is authorized; 

C) (U//FOUO) The administrative subpoena may request only records that are authorized under 
the pertinent law; 


D) (U//FOUO) The administrative subpoena must be approved by an authorized official; 



F) (U//FOUO) The return of service information must be completed on the back of the original 


b7E 


in the SBP sub-file or uploaded as a 1 A to the case file, following your office practices; 

G) (U//FOUO) The original administrative subpoena and completed return of service must be 
maintained in a SBP sub-file of the investigation. Provided a copy of the app roved subp oena 

and a copy of the completed return of service are serialized to the case file in | the b7E 

SBP sub-file is not mandated. T his only applies to those administrative subpoenas which are 
created through the A pplication; and 

H) (U//FOUO) If the records provided in response to the administrative subpoena are subject to 
statutory privacy protections, they must be reviewed to ensure that they are within the scope of 
the request (i.e., that there is no overproduction). If an over-production has occurred, the 
procedures outlined above must be followed. 


administrative subpoena. Typed signature blocks do not affect current practices for completing 
the return of service information. Fo r electronically served subpoenas Satisfies the 

“return of service” upon the review ol | ~| 

th us no paper copy is required. For non-electronicallv served subpoenas, users must complete 
thel I 


process to satisly tne return of service requirement. This copy of the subpoena must be placed 
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18.6.5 (U) Investigative Method: Grand Jury Subpoenas (compulsory 

PROCESS) 


18.6.5.1 (U) Overview of Compulsory Process 



18.6.5.2 (U) Application 

(U//FOUQ1 





1 A grand jury subpoena may not be used tor the collection of positive 


foreign intelligence. 


18.6.5.3 (U) Federal Grand Jury Subpoena 

18.6.5.3.1 (U) Legal Authorities 

(U) A Federal Grand Jury (FGJ) is an independent panel charged with determining whether 
there is probable cause to believe one or more persons committed a particular federal offense. 
If the FGJ believes probable cause exists, it will vote a “true bill” and the person will be 
indicted. An indictment is the most typical way a person is charged with a felony in federal 
court. A FGJ can collect evidence through the use of an FGJ subpoena, which is governed by 
Rule 6 of the FRCP. FRCP 6(e) controls the release of information obtained as part of the FGJ 
proceeding. FRCP 6(e) allows federal prosecutors to share foreign intelligence, 
counterintelligence, and terrorism-related threat information, and it is the DOJ’s policy that 
such information should be shared to the fullest extent permissible by law and in a manner 
consistent with the rule. The Attorney General has issued revised Guidelines for the 
Disclosure and Use of Grand Jury Information under Rule 6(e)(3)(D) (hereinafter “FGJ- 
Guidelines”). A memorandum issued by the Deputy Attorney General on May 1 5. 2008. 
provides amplifying guidance. 
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18.6.5.3.2 (U) Scope 

(U//FOUO) FGJ subpoenas can be used to demand documents, records, testimony of 
witnesses, or any other evidence deemed relevant by a sitting grand jury. The FBI can request 
the issuance of an F GJ subpoena in coordination with the responsible USAO in all criminal 
investigative matters.! 


F GJ subpoenas are part of the investigative process. Thus, when an individual is 
indicted, further FGJ subpoenas may not be issued that are related to those offenses. 
Additional subpoenas pertaining to this individual could be issued, however, for any crimes 
that continue to be investigated and have not yet been indicted. FGJ subpoenas cannot be used 
to gather evidence for trial; trial subpoenas must be used for that purpose (see Rule 17 Federal 
Rules of Criminal Procedure). 

1 8. 6. 5.3. 3 (U) Approval Requirements 


(U) There are no FBI supervisory appro val requireme nts, but all FGJ subpoenas must be 

issued by the USAO that is handling the Assessment or Predicated Investigation 

to which the subpoenaed materials or witnesses are relevant. 


18.6.5.3.4 (U) Duration of Approval 


(U) FGJ subpoenas include a “return date,” which is the date on which the subpoenaed 
materials or testimony is due to the grand jury. 

1 8. 6.5.3. 5 (U) Specific Procedures 


(U) FGJ subpoenas are governed by Rule 6(e) of the Federal Rules of Criminal Procedure and 
can only be obtained in coordination with the responsible USAO or the appropriate DOJ 
division. 

18.6.5.3.5.1 (U) Members of the News Media 


(U) Approval Requirements : A grand jury subpoena directed to a provider of electronic 
communication services or any other entity seeking to obtain local and long distance 
connection records, or records of session times of calls, made by a member of the news media 
may only be issued with the specific approval of the Attorney General. Before proposing such 
a subpoena, an agent should review 28 C.F.R. § 50.10. Requests for AG approval must be 
made by the AUSA involved in the investigation consistent with the DOJ policies set forth in 
28 C.F.R. § 50.10. Guidance on the DOJ policy may be obtained from the Investigative Law 
Unit and/or the Privacy and Civil Liberties Unit, OGC. 
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18.6.5.3.6 (V) Notice and Reporting Requirements 

(U) There is no FBI notice or reporting requirements for FGJ subpoenas. 

18.6.5.3. 7 (U) Grand Jury Proceedings — Generally 

1 8.6.5.3.7. 1 (U) Procedural Issues and Handling of FGJ Materials 

(U) The FGJ makes its determination whether to return a “true bill of indictment” based 
on evidence presented by the prosecuting attorney in an ex parte proceeding. The grand 
jury operates under the direction and guidance of the United States District Court. 
Generally, only witnesses for the prosecution testify before the grand jury. 

(U) Only the United States Attorney or an assistant, other DOJ attorneys prosecuting the 
matter, the witness under examination, an interpreter (as needed), and the stenographer or 
operator of a recording device may be present while the grand jury is in session. No judge 
is present during the presentation of evidence although the court will sometime rule on 
evidentiary issues and will provide initial instructions to the FGJ. No person other than 
the grand jurors may be present while the grand jury is deliberating or voting. 

1 8.6.5.3 .7.2 (U) Restrictions on Disclosure 

(U) As a general rule, no one other than a grand jury witness may disclose matters 
occurring before the grand jury. Government agents, even if called as witnesses, may not 
disclose matters occurring before the grand jury. 

1 8.6.5.3.7.3 (U) Exceptions Permitting Disclosure 

18 . 6 . 5 . 3 . 7 . 3.1 (U) Disclosures by the government without the court’s 

permission 

(U//FOUO) The government, through its attorney, may disclose grand jury matters under 
the following conditions: 

A) (U) Under Rule 6(e)(3)(A), the government may disclose a grand jury matter to certain 
persons in certain situations provided the government does not disclose the grand jury's 
deliberations or any grand juror's vote and the government provides the court that impaneled 
the grand jury with the names of all persons to whom disclosure was made and certifies that 
the government has advised the receiving party of the obligation of secrecy under this rule. 

B) (U) Persons eligible to receive material under this subsection are: 1) an attorney for the 
government for use in performing that attorney's duty; 2) any government personnel, including 
state, local, tribal, or foreign government personnel that an attorney for the government 
considers necessary to assist in performing that attorney's duty to enforce federal law; and 3) a 
person authorized under 18 U.S.C. § 3322. 

C) (U) For these purposes, OGC attorneys and CDCs are not "attorneys for the government." For 
purposes of the Rules of Criminal Procedure, FRCP 1 defines “attorney for the government” 
as “the Attorney General, an authorized assistant of the Attorney General, a United States 
Attorney, [and] an authorized assistant of the United States Attorney.” 
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D) (U) An attorney for the government may disclose any grand jury matter to another FGJ. 

E) (U) An attorney for the government may disclose any grand jury matter involving foreign 
intelligence, counterintelligence, or foreign intelligence information to any federal law 
enforcement, intelligence, protective, immigration, national defense, or national security 
official to assist the official receiving the information in the performance of that official's 
duties. The government attorney must file, under seal, with the court that impaneled the grand 
jury, a notice that such information was disclosed and the agencies or departments that 
received the information. As used in Rule 6(e), foreign intelligence information is information 
that relates to the ability of the United States to protect against actual or potential attack or 
grave hostile acts by a foreign power or its agents; sabotage or international terrorism by a 
foreign power or its agents or clandestine intelligence activities by an intelligence service or 
network of a foreign power or its agents; or information with respect to a foreign power or 
foreign territory that relates to the national defense or security of the United States or the 
United States conduct of foreign affairs. 

F) (U) An attorney for the government may disclose any grand jury matter involving, either in 
the United States or elsewhere, a threat of attack or other grave hostile acts of a foreign power 
or its agent, a threat of domestic or international sabotage, or clandestine intelligence 
gathering activities by an intelligence service or network of a foreign power or by its agent to 
any appropriate federal, state, local, tribal, or foreign government official for the purpose of 
preventing or responding to such threat or activities. The government attorney must file, under 
seal, with the court that impaneled the grand jury, a notice that such information was disclosed 
and the agencies or departments that received the information. 

18. 6.5.3. 7.3.2 (U) DISCLOSURES BY THE GOVERNMENT REQUIRING THE COURT’S 

PERMISSION 

(U//FOUO) The government, through its attorney, may disclose grand jury matters under 
the following conditions only with permission of the court. Petitions to make these 
disclosures are generally, but not always, filed with the court that impaneled the grand 
jury. Unless the hearing on the government’s petition is to be ex parte, the petition must 
be served on all parties to the proceedings and the parties must be afforded a reasonable 
period of time to respond. 

A) (U) An attorney for the government may petition for disclosure to a foreign court or 
prosecutor for use in an official criminal investigation. 

B) (U) An attorney for the government may petition for disclosure to a state, local, tribal, or 
foreign government official, if the government attorney can show that the matter may disclose 
a violation of state, tribal, or foreign criminal law, and the purpose of the disclosure is to 
enforce that law. 

C) (U) An attorney for the government may petition for disclosure to an appropriate military 
official if the government attorney can show the matter may disclose a violation of military 
criminal law under the Uniform Code of Military Justice, and the purpose of the disclosure is 
to enforce that law. 

18.6.5.3. 7.3.3 (U) FBI’s Conduit Rule 

(U//FOUO) Only the federal prosecutor is authorized to make an initial disclosure of 
Rule 6(e)(3)(D) foreign intelligence information. As a practical matter, such disclosures 
are ordinarily accomplished through the FBI, which may have existing information- 
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sharing mechanisms with authorized receiving officials. If the prosecutor intends to share 
information directly with another official, consultation with the FBI is required to ensure 
that disclosures will be consistent with the existing policy of intelligence community 
agencies and to ensure appropriate handling of sensitive or classified information. 

' “ ' " 1 b7E 


(U//FOUO) If, in cases of emergency, the prosecutor must disclose information before 
consulting with the FBI, the prosecutor must notify the FBI as soon as practicable. 

18 . 6 . 5 . 3 . 7 . 3.4 (U) Other Limitations 

(U) Rule 6(e)(3)(D) does not eliminate certain other information protection requirements, 
such as restrictions on disclosure of tax returns and tax information, on certain financial 
information under the Right to Financial Privacy Act, and on classified information, to 
name only a few examples. Specific statutes may impose additional burdens of 
disclosures. 

18.6.5.3.7.4 (U) Disclosure 

A) (U) An FBI employee may become a “receiving official,” i.e., the person to whom grand jury 
information can be disclosed, if the FBI receives grand jury information developed during 
investigations conducted by other agencies. A receiving official is any federal, state, local, 
tribal, or foreign government official receiving grand jury information, disclosed by an 
attorney for the government, under any provision of Rule 6(e)(3)(D). A receiving official may 
only use the disclosed material as necessary in the conduct of his/her official duties. The 
receiving official ordinarily must consult with the federal prosecutor before disseminating the 
information publicly, including in open court proceedings. 

B) (U//FOUO) Receiving officials may only use grand jury information in a manner consistent 
with FGJ Guidelines and any additional conditions placed on the use or handling of grand jury 
information by the attorney for the government. 

C) (U//FOUO) If dissemination is necessary to the performance of his or her official duties, a 
receiving official may disseminate Rule 6(e)(3)(D) information outside of that official's 
agency to other government officials. 

D) (U) A receiving official, other than a foreign government official, must consult with the 
attorney for the government before disseminating Rule 6(e)(3)(D) information publicly 
(including through its use in a court proceeding that is open to or accessible to the public), 
unless prior dissemination is necessary to prevent harm to life or property. In such instances, 
the receiving official shall notify the attorney for the government of the dissemination as soon 
as practicable. 

E) (U) A foreign government receiving official must obtain prior consent from the disclosing 
official where possible, or if the disclosing official is unavailable, from the agency that 
disseminated the information to that foreign official before dissemination of the information to 
a third government or publicly. Public dissemination includes using the information in a court 
proceeding that is open to or accessible by the public. 
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F) (U) A receiving official shall handle Rule 6(e)(3)(D) information in a manner consistent with 
its sensitivity and shall take appropriate measures to restrict access to this information to 
individuals who require access for the performance of official duties. 

G) (U) A receiving official shall immediately report to the disclosing attorney for the 
government: any unauthorized dissemination of Rule 6(e)(3)(D) information; or any loss, 
compromise, or suspected compromise of Rule 6(e)(3)(D) information. 

18.6.5.3.7.4.1 (U) Violations 

A) (U) A receiving official who knowingly violates Rule 6(e)(3)(D) by using the disclosed 
information outside the conduct of his or her official duties, or by failing to adhere to any 
limitations on the dissemination of such information, may be subject to contempt of court 
proceedings and to restriction on future receipt of Rule 6(e)(3)(D) information. 

B) (U) A state, local, tribal, or foreign government official who receives Rule 6(e)(3)(D) 
information, and who knowingly violates these guidelines, may be subject to contempt of 
court proceedings. 

C) (U) An attorney for the government who knowingly violates Rule 6(e)(3)(D) may be subject 
to contempt of court proceedings. 

18. 6.5.3. 7.4.2 (U) Limitation on Unauthorized Disclosures 

(U) Rule 6(e)(3)(D)(i) provides that receiving officials may use disclosed information 
only to conduct their “official duties subject to any limitation on the unauthorized 
disclosure of such information.” This “limitation on unauthorized disclosures” is 
understood to encompass applicable statutory, regulatory, and guideline restrictions 
regarding classification, privacy, or other information protection, as well as any 
additional restrictions imposed by the federal prosecutor. 

(U//FOUO) The FGJ Guidelines do not require the receiving official to notify the federal 
prosecutor of subsequent disclosures, except for consultation concerning public 
disclosures and consent for certain disclosures by foreign officials. The receiving official 
is bound by whatever restrictions govern his or her use and disclosure of the information 
as part of his official duties. (Memo dated 5/1 5/08. Guidelines for the Disclosure and Use 
• of FGJ Information under Rule 6reir3HDl ). 

18.6.5.3. 7.4.3 (U) LIMITATION OF USE 

A) (U//FOUO) Because of the restrictions involved in handling information that is obtained by 
the use of a grand jury subpoena, whenever possible, alternatives to the grand juiy subpoena, 
such as administrative subpoenas, search warrants and witness interviews should be 
considered as an alternative method of obtaining evidence. 

B) (U) A grand juiy subpoena may only be used for purposes of gathering information that is 
relevant to the grand jury’s investigation. Grand jury secrecy continues indefinitely, regardless 
of whether there is an indictment, unless the material becomes a matter of public record, such 
as by being introduced at trial. 

C) (U) Rule 6(e)(3)(D) does not require notice to the court of subsequent dissemination of the 
information by receiving officials. 
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D) (U//FOUO) Disclosure of grand jury material cannot be made within the FBI for unrelated 
investigations unless a government attorney has determined that such disclosure to a particular 
investigator is needed to assist that attorney in a specific criminal investigation. The ability of 
government attorneys to freely share grand jury material with other government attorneys for 
related or unrelated criminal investigations does not extend to investigators without 
investigation specific authorization from the government attorney and notice to the court. 
Therefore, grand jury material must be restricted when placed into a general system of 
records that is freely accessible to FBI employees and others with access (e.g., the FBI’s 
central recordkeeping system). 

E) (U//FOUO) If a government attorney authorizes the disclosure of grand jury material in the 
possession of the FBI for use in an unrelated federal' criminal matter, such approval must be 
documented in the GJ sub-file of both the initiated investigation file and the subsequent 
investigation file. That documentation will be in addition to any necessary supplementation to 
the government attorney's FRCP Rule 6(e) disclosure letter and/or to the internal disclosure 
list. 

F) (U//FOUO) The US AO should be consulted immediately for precautionary instructions if 
grand jury material will have application to civil law enforcement functions (e.g., civil RICO 
or civil forfeiture). There are very limited exceptions that allow government attorneys to use 
grand jury material or information in civil matters (e.g., civil penalty proceedings concerning 
banking law violations). These exceptions do not automatically apply to investigative 
personnel. Therefore, any similar use of grand jury information by the FBI must be approved 
in advance by the government attorney. 

G) (U//FOUO) Disclosure cannot be made without a court order for use in non-criminal 
investigations, such as background investigations or name checks. 

H) (U//FOUO) Government personnel who are preparing a response to a Freedom of Information 
Act or Privacy Act request may properly access grand jury material under the Rule because 
they are considered to be assisting the grand jury attorney by ensuring against any improper 
disclosure. 


18. 6.5.3. 7.4.4 (U) Matters Occurring Before the Grand Jury 


A) (U) Core Grand_ Jury Material : There can be no dissemination of matters occurring before the 
grand jury unless such dissemination comes within one of the exceptions discussed above. 
There is no uniform legal definition of what constitutes matters occurring before the grand 
jury except for what is generally referred to as "core" grand jury material. “Core grand jury 
material” includes the following: (i) names of targets and witnesses; (ii) grand jury testimony; 
(iii) grand jury subpoenas; (iv) documents with references to grand jury testimony (including 
summaries and analyses); (v) documents that clearly reveal the intentions or direction of the 
grand jury investigation; and (vi) other material that reveals the strategy, direction, testimony, 
or other proceedings of a grand jury. 

B) (U) Documents Created^ Independent of Grand Jury but Obtained^ by Grand. Jury Subpoena : 
Rule 6(e) generally prohibits disclosing “matters occurring before the grand jury.” The rule, 
however, does not define that phrase. The issue of whether pre-existing documents fall within 
that prohibition has never been settled conclusively by the Supreme Court, although many 
lower courts have discussed it at length. Courts generally agree that this prohibition does not 
cover all information developed in the course of a grand jury investigation; rather, the secrecy 
rule applies only to information that would reveal the existence, strategy or direction of the 
grand jury investigation, the nature of the evidence produced before the grand jury, the views 
expressed by members of the grand jury, or anything else that actually occurred before the 
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grand jury. In addition, courts have frequently held that Rule 6(e) does not protect documents 
subpoenaed by the government from third parties only for the information contained within 
the document rather than to determine the direction or strategy of the grand jury investigation. 
Due to developing law on this issue, FBI personnel should consult with the AUSA 
responsible, or the CDC/OGC, to determine how best to handle such documents. 

C) (U//FOUO) Data Extracted from Records Obtained, by Grand Jury Subpoena : Information 
extracted from business records that were obtained by grand jury subpoena is often used to 
facilitate investigations. Some of that type of data is, by statute or case law, subject to grand 
jury secrecy rules. In other investigations, determination of whether data must be considered 
subject to grand jury secrecy rules depends on the case law and local practice in the federal 
district. Information extracted from grand juiy subpoenaed financial records subject to the 
Right to Financial Privacy Act of 1978 (12 U.S.C. § 3420) must be treated as grand jury 
material “unless such record has been used in the prosecution of a crime for which the grand 
jury issued an indictment or presentment or for a purpose authorized bv rule 6(el of the 
Federal Rules of Criminal Procedure ." (emphasis added). Rule 6(e)(3)(B) authorizes grand 
jury material to be used "to assist an attorney for the government in performing that attorney's 
duty to enforce federal criminal law." Use of information obtained through a grand jury 
subpoena by FBI employees to advance an investigation does not constitute a disclosure of 
grand jury information in violation of Rule 6(e). With the approval of the USAO, information 
from subpoenaed telephone records may be disclosed for use in unrelated federal criminal 
investigations in those districts where such material is not considered a “matter occurring 
before a grand jury.” If the USAO approves generally of this procedure, such information may 
be used in unrelated criminal investigations without authorization from a government attorney 
in each instance. 


18.6.5.3.7.4.5 (U) Federal Grand Jury Physical Evidence and Statements of 

Witnesses 

A) (U) Physical evidence provided to the government in response to a grand jury subpoena is 
subject to the secrecy rule regardless of whether such evidence is presented to the grand jury. 
Physical evidence provided voluntarily or obtained by means other than grand jury process 
(such as by consent or a search warrant) is not a grand jury matter regardless of whether such 
evidence was previously or is thereafter presented to the grand jury. The fact that the physical 
evidence was presented to the grand jury is, however, subject to the grand jury secrecy rules. 

B) (U) Statements of witnesses obtained as a result of grand jury process including grand jury 
subpoena, such as a statement given in lieu of grand jury testimony, are matters occurring 
before the grand jury irrespective of whether such witnesses testified before the grand jury or 
are not required to testify. Voluntary statements of witnesses made outside of the grand jury 
context (not pursuant to any grand jury process including a grand jury subpoena), including 
statements made outside the grand jury by a witness who is being prepared for grand jury 
testimony, are not grand jury matters irrespective of whether the witness previously testified 
or will thereafter testify before the grand jury. 

C) (U) Rule 6(e)(3)(B) requires a federal prosecutor who discloses grand jury material to 
government investigators and other persons supporting the grand jury investigation to 
promptly provide the court that impaneled the grand jury the names of the persons to whom 
such disclosure has been made and to certify that he/she has advised such persons of their 
obligation of secrecy under the Rule. In order to document the certification required by the 
Rule, government attorneys often execute and deliver to the court a form, normally referred to 
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as a “Certification” or “Rule 6(e) letter.” A copy of this document should be maintained with 
the grand jury material held in the FBI's custody. 

D) (U//FOUOJ documentation o£ Internal Disclosures o£_ Grand Jury Material : Grand iurv 
material should be kept in such as fashion as to maintain the integrity of the evidence. Upon 
taking custody of grand jury material, the FBI employee should categorize it in a manner to 
identify its production source and how it was obtained, to include the identity of a custodian of 
record for documentary evidence. Practical considerations often require agents assisting 
government attorneys to seek assistance in the same investigation from others within the FBI. 
In many districts, professional staff and supervisors of case agents need not be routinely 
included in the list provided to the court. In lieu of a Rule 6(e) letter from the USAO 
containing an exhaustive list of names of FBI personnel, an FBI record of additional internal 
disclosures must be maintained by the case agent in order to establish accountability. Use of 
this "internal certification" procedure should be authorized by the appropriate USAO. The 
internal form must record the date of disclosure as well as the identity and position of the 
recipient. Such internal disclosures may be made only in support of the same investigation in 
which a federal prosecutor has previously issued a Rule 6(e) letter. In addition, the internal 
record must reflect that all recipients of grand jury materials were advised of the secrecy 
requirements of Rule 6(e). Whenever practicable, recipients should be listed on this internal 
certification prior to disclosure. Local Rule 6(e) customs should govern the internal 
certification process used. 

E) (U//FOUO) Storage of_ Grand Jury Material : The FBI cannot make or allow unauthorized 
disclosure of grand jury material. Material and records obtained pursuant to the grand jury 
process are frequently stored in FBI space. FBI personnel should report any unauthorized 
disclosure to the appropriate government attorney who, in turn, must notify the court. In order 
to protect against unauthorized disclosure, grand jury material must be secured in the 
following manner: 

1) (U//FOUO) The cover, envelope, or container containing grand jury materials must be 
marked with the warning: "GRAND JURY MATERIAL - DISSEMINATE ONLY 
PURSUANT TO RULE 6(e)." No grand jury stamp or mark should be affixed to the 
original material. Agents, analysts and other authorized parties should work from copies of 
grand jury material whenever possible to ensure the original material retains its integrity. 

2) (U//FOUO) Access to grand jury material must be limited to authorized persons (e.g., 
those assisting an attorney for the government in a specific criminal investigation). All 
necessary precautions should be taken to protect grand jury material, to include 
maintaining the material in a secure location when not in use. The material must be 
appropriately segregated, secured, safeguarded and placed in the investigative GJ sub-file 
for FGJ material. Absent chain-of-custody considerations, grand jury material may be 
maintained in the 1 A section of the file. Grand jury material need not be kept in an 
evidence or bulky exhibit room and may be entrusted to a support services technician 
(SST) or evidence control technician (ECT). Should grand jury material be entered into a 
computer database, the data must be marked with the 6(e) warning and restricted within the 
system. 

3) (U//FOUO) Registered mail or other traceable courier (such as Federal Express) approved 
by the Chief Security Officer (CSO) must be used to mail or transmit to other field offices 
any documents containing grand jury material. Couriers and other personnel employed in 
these services will not be aware of the contents of the material transmitted because of the 
wrapping procedures specified below, and therefore, then do not require a background 
investigation for this purpose. The names of persons who transport the material need not be 
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placed on a disclosure list, but the receiving office must provide the case agent in the 
originating office with the names of personnel in the receiving office to whom disclosure is 
made. 

4) (U//FOUO) Grand jury material that is to be mailed or transmitted by traceable courier 
outside a facility must be enclosed in opaque inner and outer covers. The inner cover must 
be a sealed wrapper or envelope that contains the addresses of the sender and the 
addressee, who must be authorized to have access to the grand jury material. The inner 
cover must be conspicuously marked "Grand Jury Information To Be Opened By 
Addressee Only." The outer cover must be sealed, addressed, return addressed, and bear no 
indication that the envelope contains grand jury material. When the size, weight, or nature 
of the grand jury material precludes the use of envelopes or standard packaging, the 
material used for packaging or covering must be of sufficient strength and durability to 
protect the information from unauthorized disclosure or accidental exposure. 

5) (U//FOUO) If the government attorney determines that the sensitivity of, or threats to, 
grand jury material necessitates a more secure transmission method, the material may be 
transmitted by an express mail service approved for the transmission of national security 
information or be hand carried by the assigned government attorney or his or her 
designated representative. 

6) (U//FOUO) Grand jury material containing classified national security information must 
be handled, processed, and stored according to 28 C.F.R. Part 17. Grand jury material 
containing other types of sensitive information, such as federal tax return information, 
witness security information, and other types of highly sensitive information that have 
more stringent security requirements than that usually required for grand jury material 
must be stored and protected pursuant to the security regulations governing such 
information and any special security instructions provided by the organization that 
originated the information. 

7) (U//FOUO) Original documents that are obtained through the grand jury process should be 
returned to the attorney for the government, or, with the government attorney's permission, 
to the owner if there is no indictment or the prosecution has concluded. 

18 . 6 . 5 . 3 . 7 . 4.6 (U) Requests for Subpoenas in Fugitive Investigations 

(U//FOUO) Thefunction of the grand jury is to decide whether a person should be 
charged with a federal crime. Locating a person who has been charged is a task that is 
ancillary to, rather than a part of, that function. As such, grand jury subpoenas cannot be 
used as an investigative aid in the search for a fugitive in whose testimony the grand jury 
has no interest. Absent one the exceptions discussed below being applicable, grand jury 
subpoenas for testimony or records related a fugitive's whereabouts may not be requested 
in FBI fugitive investigations. 

(U//FOUO) If the grand jury has a legitimate interest in the testimony of a fugitive 
regarding an ongoing investigation, it may subpoena other witnesses and records in an 
effort to locate the fugitive. In this situation, the responsible Assistant Attorney General 
must approve a "target" subpoena for the fugitive before the grand jury may subpoena 
witnesses and records to locate the fugitive. 

(U//FOUO) When a fugitive's present location is relevant to an offense under 
investigation, the grand jury may legitimately inquire as to the fugitive's whereabouts. 
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Offenses such as harboring, misprision of a felony, and accessory after the fact are 
examples of crimes as to which, the fugitive's location may be relevant evidence. If, 
however, the person who is suspected of harboring the fugitive or being an accessory 
after the fact has been immunized and compelled to testify regarding the location of the 
fugitive, this will likely be viewed as improper subterfuge. 

(U//FOUO) DOJ policy generally forbids the use of grand jury subpoenas to locate a 
defendant charged in a federal criminal complaint with unlawful flight to avoid 
prosecution (UFAP). UFAP investigations are, as a general rule, not prosecuted. Use of 
the grand jury in the investigation of a UFAP matter requires prior consultation with DOJ 
and written authorization to prosecute from the Assistant Attorney General in charge of 
the Criminal Division. Federal indictments for UFAP require prior written approval of 
the Attorney General, Deputy Attorney General, or an Assistant Attorney General. 

18.6.5.3.7.5 (U) Overproduction 

(U) If any of the information received in response to a FGJ subpoena is subject to 
statutory privacy protections (e.g., records subject to the Electronic Communications 
Privacy Act (ECPA), Right to Financial Privacy Act (RFPA), the Fair Credit Reporting 
Act (FCRA), Health Insurance Portability and Accountability Act (HIPAA), or the 
Buckley Amendment), it must be reviewed at the time it is received by the employee who 
requested the issuance of the FGJ subpoena to ensure that the information received is 
within the scope of the subpoena’s demand. Any information received from a third party 
provider that is beyond the scope of the FGJ subpoena and is subject to statutory 
protections must be treated as an overproduction. Overproduced material must not be 
serialized into any FBI application database or used in any manner. Instead, the FBI 
employee must promptly notify the AUSA who authorized the issuance of the FGJ 
Subpoena of the potential overproduction. The AUSA, in coordination with the FBI 
employee, must determine whether the information exceeds the scope of the FGJ 
subpoena, and if so, how to dispose of the overproduced material. Whatever disposition 
of the overproduction is chosen it must be documented in the investigative GJ sub-file for 
FGJ subpoenas. 
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18.6.6 (U) Investigative Method: National Security Letter (Compulsory 

Process) 

18.6.6.1 (U) Overview of Compulsory Process 



18.6.6.2 (U) APPLICATION 

(U//FOUO) NSLs may be used in a national security Predicated Investigation. This method 
may not be used for assistance to other government agencies, unless the information sought is 
relevant to an open FBI Predicated Investigation. 

18.6.6.3 (U) National Security Letters 

18.6.6.3.1 (U) Legal Authority 

A) (U) 12 U.S.C. § 3414(a)(5)(A); 

B) (U) 15 U.S.C. §§ 1681u and 1681v; 

C) (U) 18 U.S.C. § 2709; 

D) (U) 50 U.S.C. § 436; 

E) (U) AGG-Dom, Part V; and 

F) (U) An NSL may be used only to request: 

1) (U) Financial Records: The Right to Financial Privacy Act (RFPA), 12 U.S.C. § 
3414(a)(5); 

2) (U) Identity of Financial Institutions: Fair Credit Reporting Act (FCRA), 15 U.S.C. § 
1681u(a); 

3) (U) Consumer Identifying Information: FCRA, 15 U.S.C. § 1681u(b); 

4) (U) Full Credit Reports in International Terrorism Investigations: FCRA, 15 U.S.C. § 

168 lv; and 
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5) (U) Telephone Subscriber Information, Toll Billing Records, Electronic Communication 
Subscriber Information, and Electronic Communication Transactional Records: Electronic 
Communications Privacy Act (ECPA), 18 U.S.C. § 2709. 

18.6.6.3.2 (U) Definition of Method 

(U) An NSL is an administrative demand for documents or records that are relevant to a 

Predicat ed Investigation to protect against internationa l terrorism or clandestine intelligence 

activities f | b7E 

1 8. 6. 6.3.3 (U) Approval Requirements 

(U//FOUO) Those who approve NSLs are responsible for ensuring the investigative and 
procedural requirements have been met. They must certify that the information sought by the 
NSL is relevant to an open, predicated national security investigation. For an NSL to include a 
nondisclosure provision, the approver must determine that disclosure of the NSL may 
endanger the national security of the United States; interfere with a criminal, 
counterterrorism, or counterintelligence investigation; interfere with diplomatic relations; or 
endanger the life or physical safety of any person. Those who approve NSLs, as well as those 
designated as acting officials who will approve NSLs, must have completed the Virtual 
Academy course on NSLs, reviewed DIOG Section 18.6.6. (National Security Letter), and if 
appropriate, received NSL training from the CDC/ADC or a National Security Law Branch 
(NSLB) attorney prior to approving NSLs. 

(U//FOUO) The process for creating an NSL involves two documents: the NSL itself and the 
EC approving the issuance of the NSL. The Director has delegated the authority to sign NSLs 
to the Deputy Director, Executive Assistant Director, and Associate EAD for the National 
Security Branch; Assistant Directors and all DADs for the Counterterrorism, 

Counterintelligence, and Cyber Divisions, and the Weapons of Mass Destruction Directorate; 

General Counsel; Deputy General Counsel for the National Security Law Branch; Assistant 
Directors in Charge in New York, Washington, DC, and Los Angeles; and all SACs in all 
field offices. See EC 333-HQ-A1487720 Serial 515 (May 15, 2012). No other delegations are 
permitted. This delegation includes FBI officials properly designated to serve in these 
positions in an acting capacity. 

b7E 


(U//FOUO) In addition to being signed by a statutorily required approver, every NSL must be 
approved by a CDC, ADC (or attorney acting in that capacity), or an NSLB attorney. 
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18.6.6.3.4 (U) Standards for Issues NSLs 
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18.6.6.3.5 (U) Special Procedures for Requesting Communication Subscriber 

Information 


tUZ/FOUPlf 


(UZZFQUol 



b7E 


b7E 


b7E 


(UZZFOUO)I I 



18.6.6.3.6 

(U) Duration of Approval 

(U//FOUO)T 
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(U) Specific Procedures for Creating NSLs 
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1 8.6.6.3.7. 1 (U) Cover EC Approving an NSL 
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P ) (uy/FQuof 




E) 
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(U//FOUO)) 


(U//FOUO) 


i) (u//fouo| 1 



j) (U//FOUO' 

k: 


(U//FOUC| 


L) 

(F 

(U//FOUO 

I//FOUO) This list is not exhaustive. 


1 8.6.63.7.2 (U) Copy of the NSL and Related Documents in the 

Investigative File 
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18.6.6.3.7.3 (U) Community of Interest Information 



18.6.6.3.7.4 (U) Contact with members of the news media by a| 



18.6.6.3.7.5 (U) EMERGENCY CIRCUMSTANCES 


(U//FOUO) ECPA protects subscriber or communications transactional information from 
disclosure by providers of electronic communication services. Generally, an NSL, grand 
jury subpoena, or another form of legal process must be used to compel a communication 
service provider to disclose subscriber or transactional information. In emergency 
circumstances, however, the provider may voluntarily disclose information to the FBI if 
the provider, in good faith, believes that an emergency involving danger of death or 
serious physical injury to any person exists and requires disclosure without delay. As a 
matter of FBI policy, when there is a danger of death or serious physical injury that does 
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not permit the proper processing of an NSL, an administrative subpoena (if permissible), 
or a grand jury subpoena, then a letter to the provider citing 18 U.S.C. § 2702 may be used to 
request emergency disclosure, if approved by a SAC, ASAC, or FBIHQ Section Chief. If 
time does not permit the issuance of an emergency letter that cites 18 U.S.C. § 2702, then 
an oral request to the provider may be made, but the oral req uest must be followed-up 
with a letter to the provider. In either situation, a d Form, which automatically 

generates the letter, must be completed. 

(U//FOUO)| 



1 8. 6. 6.3.8 (U) Notice and Reporting Requirements 

(U//FOUO ) NSLB com piles NSL statistics for reporting to Congress. The NSL 
subsystem | automatically records the information needed for Congressional 

reporting. If the NSL is created outside the subsystem, then the NSL’s cover EC must 
include the information necessary for NSLB to report NSL statistics accurately, i.e., 
delineate the number of targeted facilities/accounts in each NSL issued to an NSL 
recipient. 

(U//FOUO) NSLB also reports to Congress the USPER status of the target (as opposed to 
the subject of the investigation) of all NSLs, other than NSLs that seek only subscriber 
information. While the subject of the investigation is often the target of the NSL, that is 
not always the case. The EC must record the USPER status of the target of the NSL - the 
person whose information the FBI is seeking. If the NSL is seeking information about 
more than one person, the EC must record the USPER status of each person. 

18.6.6.3.9 (U) Receipt of NSL Information, Review for Overproduction, and Releasing 

THE INFORMATION 
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18.6.6.3.12 (U) Electronic Service and Electronic Returns of NSLs 
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(U//FOUO) Subject to certain statutory limitations, information obtained in response to an 
NSL may be disseminated according to general dissemination standards in the AGG-Dom. 
The ECPA (telephone and electronic communications transactional records) and RFPA 
(financial records) permit dissemination if consistent with the AGG-Dom and the information 
is clearly relevant to the responsibilities of the recipient agency. FCRA permits dissemination 
of identity of financial institutions and consumer identifying information to other federal 
agencies as may be necessary for the approval or conduct of a foreign counterintelligence 
investigation. FCRA imposes no special rules for dissemination of full credit reports. 

(U//FOUO)| 


heither an NSL nor the information received in 


response to an NSL is classified.! I 



18 . 6 . 6 . 3.14 

(U) Special Procedures for Handling Right to Financial Privacy Act 
Information and Other Information 

(U//FOUOF 
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(U//FOUOJ 


(U//FOUO; 


18.6.6.3.15 (U) Pa yment for NSL Derived Informa tion 

(U//FOUO) No legal obligation exists for the FBI to compensate recipients of NSLs issued 
pursuant to ECPA (telephone and electronic communications transactional records) or FCRA, 
15 U.S.C. § 1681v (full credit reports in international terrorism investigations), and therefore 
no payment should be made in connection with those NSLs. See EC 319X-HQ-A1487720- 
OGC, serial 222, for a form letter to be sent in response to demands for payment concerning 
these NSLs. 

(U//FOUO) Compensation for responding to NSLs issued pursuant to RFPA (financial 
records) and FCRA § 1681u (identity of financial institutions and consumer identifying 
information) is covered by a fee schedule adopted under 12 C.F.R. § 219.3, Appendix A, 
which is available on the QGC website 


1 8. 6. 6.3.16 (U) Judicial Review of NSLs 

(U//FOUO) All NSLs should include the necessary legal notices. Specifically, an NSL issued 
by the FBI shall inform the recipient of the right to judicial review of the NSL pursuant to the 
procedures set forth in 18 U.S.C. § 351 1(a). See Doe v. Mukasev. 549 F.3d 861 (2d Cir. 
2008). An NSL issued by the FBI shall also inform the recipient of the right to judicial review 
of any nondisclosure requirement imposed in connection with the NSL. An NSL shall 
specifically advise that, if the recipient wishes to make a disclosure that is prohibited by the 
nondisclosure requirement, the recipient must notify the FBI within 10 calendar days of 
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receipt of the NSL, in accordance with notification instructions set forth in the NSL. The NSL 
shall further advise that the Government will initiate judicial review proceedings within 30 
days of receiving such a notification, and that the nondisclosure requirement will remain in 
effect unless and until there is a final court order holding that disclosure is permitted. If the 
recipient does not activate the Government-initiated judicial review by providing notice to the 
Government within 10 calendar days of receipt of the NSL, then the nondisclosure 
requirement will remain in effect, subject to the recipient’s opportunity to make an annual 
challenge to the nondisclosure requirement as provided by 18 U.S.C. § 351 1(b). 

(U//FOUO) In any judicial review proceeding regarding a nondisclosure requirement imposed 
in connection with an NSL, the Government will bear the burden of persuading the district 
court that there is good reason to believe that disclosure may result in one or more of the 
enumerated harms set forth at 18 U.S.C. § 2709(c): a danger to the national security of the 
United States; interference with a criminal, counterterrorism, or counterintelligence 
investigation; interference with diplomatic relations; or danger to the life or physical safety of 
any person, that is related to an authorized investigation to protect against international 
terrorism or clandestine intelligence activities. The Government’s certification that disclosure 
may result in one of these enumerated harms will not be treated as conclusive. Accordingly, 
the field office or FBIHQ Division that issued the NSL, in conjunction with OGC, shall 
coordinate with DOJ and the United States Attorney’s Office to ensure that the Government’s 
certification is sufficient to meet the Government’s burden of proof. 
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18.6.7 (U) INVESTIGA TIVE METHOD: FISA ORDER FOR BUSINESS RECORDS 

( COMPULSORY PROCESS) 


18.6.7.1 (U) Overview of Compulsory Process 

(U//FOUQ1 


M 


18.6.7.2 (U) Application 


(U//FOUO) FI SA Business Records Orders may be used during authorized national security 


investigations. 



When collecting positive foreign 


intelligence, if the subject is a non-USPER, a request for business records pursuant to 50 
U.S.C. §§ 1861-63 is lawful. | 


18.6.7.3 (U) Business Records Under FISA 

1 8. 6. 7.3. 1 (U) Legal A uthority 

(U) 50 U.S.C. §§ 1861-63 

1 8. 6. 7.3.2 (U) Definition of Method 


(U) A FISA order for business records, is an order for a third party to produce [ 
relevant to an authorized national security investigation! 
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1 8. 6. 7.3.3 (U) Approval Requirements 

(U//FOUQ1 


(TJ//FOUO)[ 


18.6. 7.3.4 (U) Duration of Court Approval 

(U) Authority for a FISA business records order is established by court order. 

1 8. 6. 7.3.5 (U) Notice and Reporting Requirements 

(U) There are no special notice or reporting requirements. 

1 8. 6. 7.3. 6 (U) Compliance Requirements 

(U) The employee who receives material produced in response to a FISA business records 
order must do the following: 

A) (U//FOUO) Handle the material as requir ed by the Standard Minimization Procedures 

Adopted for Business Records Orders andl 

I 

1 8. 6 . 7.3 . 7 (U) See the current classified FISA Business Records standard minimization 

PROCEDURES: 

18.6.7,3.7.1 (U) FISA OVERCOLLECTION 

(U//FOUO)! 
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18 . 6.8 (U) Investigative Method: Stored Wire or Electronic 

Communications and Transactional Records 

18.6.8.1 (U) Summary 

(U//FOUO) FBI employees may acquire the contents of stored wire or electronic 
communications and associated transactional records — including basic subscriber 
information— as provided in 18 U.S.C. §§ 2701-2712 (Electronic Communications Privacy 
Act (ECPA)). Requests for voluntary disclosure under the emergency authority of 18 U.S.C. § 
2702 require prior approval from the field office ASAC or FBIHQ Section Chief when 
appropriate. 

(U//FOUO) All requests for information from electronic communication service providers 
(e.g., telephone companies, internet service providers) pertaining to a subscriber or customer 
must comply with ECPA. As used in ECPA, the term “information pertaining to a subscriber 
or customer” should be read broadly. It includes, for example, information regarding whether 
a particular individual has an account with a covered provider. Thus, unless done in 
accordance with ECPA, an FBI employee may not ask a telephone company or internet 
service provider whether John Smith has an account with the company (i.e., the FBI employee 
may not informally seek information that is statutorily protected prior to the issuance of 
appropriate process or the existence of an exception to ECPA). In addition, based on a 
November 5, 2008 interpretation of ECPA from the Office of Legal Counsel, the FBI may not 
ask a telephone company whether a given telephone number that the company services has 
been assigned to an individual. In short, in order to obtain any information specific to the 
subscriber from a telephone company or electronic communication service provider, the FBI 
must provide legal process pursuant to 18 U.S.C. §§ 2703 or 2709 or the request must fall 
within the limited exceptions established in 18 U.S.C. § 2702, and discussed below. 

(U//FOUO)! I 


18.6.8.2 (U) Application 

(U//FOUO)| ~ 


18. 6.8.2.1 (U) Stored Data 

(U) The Electronic Communications Privacy Act (ECPA) — 18 U.S.C. §§ 2701-2712 — 
governs the disclosure of two broad categories of information: (i) the contents of wire or 
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electronic communications held in “electronic storage” by providers of “electronic 
communication service” or contents held by those who provide “remote computing service” 
to the public; and (ii) records or other information pertaining to a subscriber to or customer of 
such services. The category of “records or other information” can be subdivided further into 
subscriber records (listed in 18 U.S.C. § 2703(c)(2)) and stored traffic data or other records. 

(U) Records covered by ECPA include all records that are related to the subscriber, including 
buddy lists, “friend” lists (MySpace), and virtual property owned (Second Life). These other 
sorts of records are not subscriber records and cannot be obtained with a subpoena under 18 
U.S.C. § 2703(c)(2) or an NSL under 18 U.S.C. § 2709. 

18.6.8.2.2 (U) Legal Process 

(U) The legal process for obtaining disclosure will vary depending on the type of information 
sought and whether the information is being voluntarily provided under 18 U.S.C. § 2702 
(e.g., with consent or when emergency circumstances require disclosure) or the provider is 
being compelled to provide the information under 18 U.S.C. § 2703, as outlined below. The 
process for compelling production under 18 U.S.C. § 2709 is discussed in the NSL section 
above. 


1 8. 6.8.2. 3 (U) Retrieval 

(U) Contents held in “electronic storage” by a provider of “electronic communication service” 
for 1 80 days or less can only be obtained with a search warrant based on probable cause. 
Accordingly, such records may only be obtained during a Full Investigation. 

(U) Contents held by those who provide “remote computing service” to the public and 
contents held in “electronic storage” for more than 180 days by an “electronic communication 
service” provider can be obtained with: a warrant; a subpoena with prior notice to the 
subscriber or customer; or an order issued by a court under 18 U.S.C. § 2703(d) when prior 
notice has been provided to the customer or subscriber (unless the court has authorized 
delayed notice). 

(U) Title 18 U.S.C. § 2705 establishes the standard to delay notice for an initial period of up 
to 90 days. Records or other information pertaining to a subscriber to or customer of such 
services, including basic subscriber information, can be obtained with a search warrant or an 
18 U.S.C. § 2703(d) order without notice. 

18.6.8.2.4 (U) Basic Subscriber Information 

(U) Basic subscriber information, as described in 18 U.S.C. § 2703(c)(2), can be compelled 
by a grand jury or administrative subpoena without notice. 

18.6.8.2.5 (U) Preservation of Stored Data 

(U) The government is authorized under 18 U.S.C. § 2703(f) to direct a provider to preserve 
records or other information (stored records or communications) in its possession for 90 days 
(which may be extended for an additional 90-days) pending issuance of applicable legal 
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process for disclosure. To make a preservation request, the FBI must believe that the records 
will subsequently be sought by appropriate legal process. 

18.6.8.2.6 (U) Cost reimbursement 

(U) 18 U.S.C. § 2706 requires the government to reimburse for costs incurred in providing the 
contents of communications, records, or other information obtained under 18 U.S.C. §§ 2702, 
2703, or 2704, except that reimbursement is not required for records or other information 
maintained by a communications common carrier that relate to telephone toll records and 
telephone listings obtained under 18 U.S.C. § 2703. In essence, the government does not have 
to reimburse for the cost of producing records that the provider maintains in the ordinary 
course of its business. 

18.6.8.3 (U) Legal Authority 

(U) 18 U.S.C. §§2701-2712 
(U) AGG-Dom, PartV.9 

(U) ECPA — 18 U.S.C. §§ 2701-2712 — creates statutory privacy rights for the contents of 
communications in “electronic storage” and records or other information pertaining to a 
subscriber to or customer of an “electronic communication service” and a “remote computing 
service.” The statutory protections protect the privacy of an individual’s electronic data 
contained in a networked account — that may otherwise fall outside the scope of the 
protections afforded by the Fourth Amendment — when such account or its service is owned or 
managed by a third-party provider. 

(U) ECPA generally: (i) prohibits access to the contents of wire or electronic communications 
while in “electronic storage” unless authorized (18 U.S.C. § 2701); (ii) prohibits a provider of 
service to the public from disclosing the contents of wire or electronic communications while 
held in “electronic storage,” and prohibits divulging to the government any information 
pertaining to a subscriber to or customer of such service unless authorized (18 U.S.C. § 2702); 
and (iii) authorizes the government to compel disclosure from a provider of stored contents of 
a wire or electronic communication and records or other information pertaining to a 
subscriber to or customer (18 U.S.C. § 2703). ECPA provides for reimbursement of costs 
incurred in providing the information acquired. 


jm 





18.6.8.4 (U) ECPA Disclosures 

(U) ECPA authorities can be divided into two categories: (i) compelled disclosure — legal 
process to compel providers to disclose the contents of stored wire or electronic 
communications (including e-mail and voice mail — opened and unopened) and other 
information, such as account records and basic subscriber information; and (ii) voluntary 
disclosure of such information from service providers. Each of these authorities is discussed 
below. 
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18.6.8.4.1 (U) Definitions 

A) (U) Electwnic Storage : is "any temporary, intermediate storage of a wire or electronic 
communication incidental to the electronic transmission thereof," or "any storage of such 
communication by an electronic communication service for purposes of backup protection of 
such communication." 18 U.S.C. § 2510(17). In short, "electronic storage" refers only to 
temporary storage, made in the course of transmission, by a provider of an electronic 
communication service. 

B) (U) Remote Commuting. Service (RCS) : is a service that provides “to the public” computer 
storage or processing services by means of an electronic communications system. 18 U.S.C. § 
271 1(2). In essence, a remote computing service is an off-site computer that stores or 
processes data for a customer. 

C) (U) Electwnic Commmications System : is "any wire, radio, electromagnetic, photooptical or 
photoelectronic facilities for the transmission of wire or electronic communications, and any 
computer facilities or related electronic equipment for the electronic storage of such 
communications." 18 U.S.C. §2510(14). 

D) (U) Electwnic Communication Service (ECS} : is "any service that provides to users thereof 
the ability to send or receive wire or electronic communications." 18 U.S.C. § 2510(15). For 
example, telephone companies and electronic mail companies generally act as providers of 
electronic communication services. 

18.6.8.4.2 (U) Compelled Disclosure 

(U) 18 U.S.C. § 2703 lists five types of legal process that the government can use to compel a 
provider to disclose certain kinds of information. The five mechanisms, in descending order 
of required threshold showing are as follows: 

A) (U) Search warrant; 

B) (U) 18 U.S.C. § 2703(d) court order with prior notice to the subscriber or customer; 

C) (U) 18 U.S.C. § 2703(d) court order without prior notice to the subscriber or customer; 

D) (U) Subpoena with prior notice to the subscriber or customer; and 


E) (U) Subpoena without prior notice to the subscriber or customer. 


(U 




(U) 
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1 8.6.8.4.2. 1 (U//FOUO) Notice— Orders Not to Disclose the Existence of a 
Warrant, Subpoena, or Court Order 

(U//FOUO) FBI employees may obtain a court order directing network service providers 
not to disclose the existence of compelled process if the government has no legal duty to 
notify the customer or subscriber of the process. If an 18 U.S.C. § 2703(d) order or 18 
U.S.C. § 2703(a) warrant is being used, a request for a non-disclosure order can be 
included in the application and proposed order or warrant. If a subpoena is being used to 
obtain the information, a separate application to a court for a non-disclosure order must 
be made. 

1 8.6.8.4.2.2 (U) Legal Standard 

(U//FOUO) A court may order an electronic communications service provider or remote 
computing service not to disclose the existence of a warrant, subpoena, or court order for 
such period as the court deems appropriate. The court must enter such an order if it 
determines that there is reason to believe that notification of the existence of the warrant, 
subpoena, or court order will result in: 

A) (U) Endangering the life or physical safety of an individual; 

B) (U) Flight from prosecution; 

C) (U) Destruction of or tampering with evidence; 

D) (U) Intimidation of potential witnesses; or 

E) (U) Otherwise seriously jeopardizing an investigation or unduly delaying a trial. 18 U.S.C. § 
2705(b). 

1 8.6.8.4.2.3 (U) Search Warrant 

(U//FOUO) Investigators can obtain the full contents of a network account with a search 
warrant issued pursuant to FRCP Rule 41. However, FRCP Rule 41 search warrant may 
not be issued in Preliminary Investigations. See DIOG Section 18.7.1.3.4.4. 

18.6.8.4.2.4 (U) Court Order with Prior Notice to the Subscriber or 
Customer 

(U//FOUO) Investigators can obtain everything in a network account except for 
unopened e-mail or voice-mail stored with a provider for 180 days or less using a 18 
U.S.C. § 2703(d) court order with prior notice to the subscriber unless they have obtained 
authority for delayed notice pursuant to 18 U.S.C. § 2705. ECPA distinguishes between 
the contents of communications that are in "electronic storage" (e.g., unopened e-mail) 
for less than 1 80 days, and those that have been in "electronic storage" for longer or that 
are no longer in "electronic storage" (e.g., opened e-mail). 

(U) FBI employees who obtain a court order under 18 U.S.C. § 2703(d), and either give 
prior notice to the subscriber or comply with the delayed notice provisions of 18 U.S.C. § 
2705(a), may obtain: 


18-121 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 


Version Dated: 
October 15, 2011 



§18 


UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 


A) (U) “The contents of a wire or electronic communication that has been in electronic storage in 
an electronic communications system for more than one hundred and eighty days.” 18 U.S.C. 

§ 2703(a). 

B) (U) "The contents of any wire or electronic communication" held by a provider of remote 
computing service "on behalf of . . . a subscriber or customer of such remote computing 
service," 18 U.S.C. §§ 2703(b)(l)(B)(ii), 2703 (b)(2); and 

C) (U) Everything that can be obtained using an 18 U.S.C. § 2703(d) court order without notice. 

b7E 


b7E 


18 . 6 . 8 . 4 . 2 . 4.1 (U) Legal Standard 

(U) To order delayed notice, the court must find that "there is reason to believe that 
notification of the existence of the court order may... endanger the life or physical safety 
of an individual; [lead to] flight from prosecution; [lead to] destruction of or tampering 
with evidence; [lead to] intimidation of potential witnesses; or . . . otherwise seriously 
jeopardiz[e] an investigation or unduly delay[ ] a trial." 18 U.S.C. §§ 2705(a)(1)(A) and 
2705(a)(2). The applicant must satisfy this standard anew each time an extension of the 
delayed notice is sought. 

18 . 6 . 8 . 4 . 2 . 4.2 (U) Nationwide Scope 

(U) Federal court orders under 18 U.S.C. § 2703(d) have effect outside the district of the 
issuing court. Orders issued pursuant to 18 U.S.C. § 2703(d) may compel providers to 
disclose information even if the information is stored outside the district of the issuing 
court. See 18 U.S.C. § 2703(d) ("any court that is a court of competent jurisdiction" may 
issue a 18 U.S.C. § 2703(d) order); 18 U.S.C. § 271 1(3) (court of competent jurisdiction 
includes any federal court having jurisdiction over the offense being investigated without 
geographic limitation). 

(U) 18 U.S.C. § 2703(d) orders may also be issued by state courts. See 18 U.S.C. §§ 

271 1(3), 3 127(2)(B). These orders issued by state courts, however, do not have effect 
outside the jurisdiction of the issuing state. See 18 U.S.C. §§ 271 1(3). 
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1 8.6.8.4.2.5 (U) Court Order without Prior Notice to the Subscriber or 

Customer 

(U) A court order under 18 U.S.C. § 2703(d) may compel disclosure of: 

A) (U) All "record(s) or other information pertaining to a subscriber to or customer of such 
service (not including the contents of communications [held by providers of electronic 
communications service and remote computing service])," and 

B) (U) Basic subscriber information that can be obtained using a subpoena without notice. 18 
U.S.C. § 2703(c)(1). 

18. 6.8.4.2.5.1 (U) Types of Transactional Records 

(U) The broad category of transactional records includes all records held by a service 
provider that pertain to the subscriber beyond the specific records listed in 2703(c)(2) 


(U//FOUOT 


18.6.8.4.2.5.2 (V) Cell site and Sector Information 

(U) Cell site and sector information is considered “a record or other information 
pertaining to a subscriber” and therefore, production of historical and prospective cell site 
and sector information may be compelled by a court order under 18 U.S.C. § 2703(d). 
Requests made pursuant to 18 U.S.C. § 2703(d) for disclosure of prospective cell site and 
sector information — which is delivered to law enforcement under Communications 
Assistance for Law Enforcement Act (CALEA) at the beginning and end of calls — must 
be combined with an application for pen register/trap and trace device. Some judicial 
districts will require a showing of probable cause before authorizing the disclosure of 
prospective cell site and sector information. 

18.6.8.4.2.5.3 ( U ) I 
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18 . 6 . 8 . 4 . 2 . 5.4 (U) Legal Standard 


(U) A court order under 18 U.S.C. § 2703(d) is known as an "articulable facts" court 
order or simply a "d" order. This section imposes an intermediate standard to protect on- 
line transactional records. It is a standard higher than a subpoena, but not a probable 
cause warrant. 

(U) In applying for an order pursuant to 18 U.S.C. § 2703 (d), the FBI must state 
sufficient specific and articulable facts for the court to find that there are reasonable 
grounds to believe that the contents of a wire or electronic communication, or the records 



1 8.6.8.4.2.6 (U) Subpoena with Prior Notice to the Subscriber or Customer 


(U//FOUO) Investigators can subpoena opened e-mail from a provider if they give prior 
notice to the subscriber or comply with the delayed notice provisions of 18 U.S.C. § 
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2705(a)- r I that there is reason 

to believe notification of the existence of the subpoena may have an adverse result. 

(U) FBI employees who obtain a subpoena and give prior notice to the subscriber or 

comply with the delayed notice provisions of 18 U.S.C. § 2705(a) may obtain: 

A) (U) "The contents of any wire or electronic communication" held by a provider of remote 
computing service "on behalf of . . . a subscriber or customer of such remote computing 
service." 18 U.S.C. § 2703(b)(l)(B)(i), § 2703(b)(2); 

B) (U) "The contents of a wire or electronic communication that has been in electronic storage in 
an electronic communications system for more than one hundred and eighty days." 18 U.S.C. 
§ 2703(a); and 

C) (U) Basic subscriber information listed in 18 U.S.C. § 2703(c)(2). 

(U) As a practical matter, this means thatf | 



(U) Legal standards (or delating notice : The supervisory official must certify in writing 
that "there is reason to believe that notification of the existence of the court order may... 
endangerQ the life or physical safety of an individual; [lead to] flight from prosecution; 
[lead to] destruction of or tampering with evidence; [lead to] intimidation of potential 
witnesses; or... otherwise seriously jeopardiz[e] an investigation or unduly delayQ a 
trial." 18 U.S.C. §§ 2705(a)(1)(A), 2705(a)(2). This standard must be satisfied anew 
every time an extension of the delayed notice is sought. This documentation must be 
placed with the subpoena in the appropriate investigative file. 

1 8.6.8.4.2.7 (U) Subpoena without Prior Notice to the Subscriber or 

Customer 

(U//FOUO) Without notice to the subscriber or customer, investigators can subpoena 
basic subscriber information: 

(U) name; address; local and long distance telephone connection records, or records of 
session times and durations; length of service (including start date) and types of service 
used; telephone or instrument number or other subscriber number or identity, including 
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any temporarily assigned network address; and means and source of payment for such 
service (including any credit card or bank account number)[.]” 18 U.S.C. § 2703(c)(2). 



A) (U) Legal Standard : The legal threshold for issuing a subpoena is relevance to the 
investigation. Courts are reluctant to review the “good faith” issuance of subpoenas as long as 
they satisfy the following factors 19 : (i) the investigation is conducted pursuant to a legitimate 
purpose; (ii) the information requested under the subpoena is relevant to that purpose; (iii) the 
agency does not already have the information it is seeking with the subpoena; and (iv) the 
agency has followed the necessary administrative steps in issuing the subpoena. 

(U//FOUO) In the event that a federal grand jury subpoena is used, however, appropriate 
protections against disclosure must be followed in compliance with FRCP Rule 6(e). 

B ) fU//FOUOfl 


C) (U) Members of the News Media : Approval of the Attorney general must be obtained prior to 
seeking telephone billing records of a member of the news media. (See DIOG Section 
18.6.5.1.5) 

18.6.8.4.3 (U) Voluntary Disclosure 


(U) 


A) (U) Service NOT Available to the Public: ECPA does not apply to providers of services that 
are not available "to the public;" accordingly such providers may freely disclose both contents 
and other records relating to stored communications. Andersen Consulting v. UOP. 99 1 F. 
Supp. 1041 (N.D. 111. 1998) (giving hired consulting firm employees access to UOP's e-mail 
system is not equivalent to providing e-mail to the public). 

B) (U) Services That ARE Available to the Public: If the provider offers services to the public, 
then ECPA governs the disclosure of contents and other records. 


19 (U) United States v. Morton Salt Co.. 338 U.S. 632. 642-43 119501 
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C) (U) If the provider is authorized to disclose the information to the government under 18 
U.S.C. § 2702 and is willing to do so voluntarily, law enforcement does not need to obtain a 
legal order or provide other legal process to compel the disclosure. 

D) (U) If a provider voluntarily discloses under the statute, there is no follow-up legal process 
required or available. If the provider, on the other hand, either may not or will not disclose the 
information voluntarily, FBI employees must rely on compelled disclosure provisions and 
obtain the appropriate legal orders. 

1) (U) Voluntary Disclosure of Stored Contents - ECPA authorizes the voluntary disclosure 

of stored contents when: 

a) (U) The originator, addressee, intended recipient, or the subscriber (in the case of 
opened e-mail) expressly or impliedly consents, 18 U.S.C. § 2702(b)(3); 

b) (U) The disclosure "may be necessarily incident to the rendition of the service or to the 
protection of the rights or property of the provider of that service," 18 U.S.C. § 
2702(b)(5); 

c) (U) The provider "in good faith, believes that an emergency involving danger of death 
or serious physical injury to any person requires disclosure without delay of information 
relating to the emergency,” 18 U.S.C. § 2702(b)(8); 

d) (U//FOUO) An emergency disclosure under this statutory exception is justified when 

the circumstances demand action without delay to prevent death or serious bodily 
injury; t he statute does not depend on the immediacy of the risk of danger itself. For 
example| | 


H.K Kep. No. IU7-497 at 13-14 (2UU2) accompanying t he Cyber Security 
Enhancement Act of 2002, H.R. 3482, which passed as part of the comprehensive 
Homeland Security Act of 2002, Pub. L. No. 107-296, § 225 1 16 Stat. 2135 (2002). 

e) (U) The disclosure is made to the National Center for Missing and Exploited Children, 
in connection with a report submitted thereto under Section 227 of the Victims of Child 
Abuse Act of 1990. (42 U.S.C. § 13032 and 18 U.S.C. § 2702[b][6]); or 

f) (U) The contents are inadvertently obtained by the service provider and appear to 
pertain to the commission of a crime. Such disclosures can only be made to a law 
enforcement agency. 18 U.S.C. § 2702(b)(7) 

2) (U) Voluntary Disclosure of Non-Content Customer Records - ECPA permits a 

provider to voluntarily disclose non-content customer records to the government when: 

a) (U) The customer or subscriber expressly or impliedly consents, 18 U.S.C. § 

2702(c)(2); 

b) (U) The disclosure "may be necessarily incident to the rendition of the service or to the 
protection of the rights or property of the provider of that service," 18 U.S.C. § 
2702(c)(3); 

c) (U) The provider "in good faith, believes that an emergency involving danger of death 
or serious physical injury to any person requires disclosure without delay of information 
relating to the emergency,” 18 U.S.C. § 2702(c)(4); or 
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d) (U//FOUO) Note : An emergency disclosure under this statutory exception is justified 
when the circumstances demand immediate action (i.e., obtaining/disclosing 
information "without delay") to prevent death or serious bodily injury; the statute does 
not depend on the immediacy of the risk of danger itself. For example, an e-mail that 
discusses a planned terrorist attack but not the timing of the attack would constitute an 
emergency that threatens life or limb and requires immediate action, even though the 
timing of the attack is unknown. It is the need for immediate action to prevent the 
serious harm threatened rather than the immediacy of the threat itself that provides the 
justification for voluntary disclosures under this exception. H.R Rep. No. 107-497 at 
13-14 (2002) accompanying The Cyber Security Enhancement Act of 2002, H.R. 3482, 
which passed as part of the comprehensive Homeland Security Act of 2002, Pub. L. No. 
107.-296, § 225 1 16 Stat. 2 135 (2002). 

e) (U) The disclosure is to the National Center for Missing and Exploited Children, in 
connection with a report submitted thereto under Section 227 of the Victims of Child 
Abuse Act of 1990. (42 U.S.C. § 13032 and 18 U.S.C. § 2702[c][5]) 

3 ) (U) Preservation of Evidence under 18 U.S.C. § 2703(f) f | 


a) (U)[ 


| |A governmental entity is authorized to direct providers to 

preserve stored records and communications pursuant to 18 U.S.C. § 2703(f). Once a 
preservation request is made, ECPA requires that the provider must retain the records 
for 90 days, renewable for another 90-day period upon a government request. See 18 
U.S.C. § 2703 (f)(2). 

b) (U) There is no legally prescribed format for 18 U.S.C. § 2703(f) requestsl I 


c) (U) FBI employees who send 18 U.S.C. § 2703(f) letters to network service providers 
should be aware of two limitations. First, the authority to direct providers to preserve 
records and other evidence is not prospective. Thus, 18 U.S.C. § 2703(f) letters can 
order a provider to preserve records that have already been created but cannot order 
providers to preserve records not yet made. If FBI employees want providers to record 
information about future electronic communications, they must comply with the 
electronic surveillance statutes. A second limitation of 18 U.S.C. § 2703(f) is that some 
providers may be unable to comply effectively with 18 U.S.C. § 2703(f) requests 


4) (U) Video Tape Rental or Sales Records - 18 U.S.C. § 2710 makes the unauthorized 
disclosure of records by any person engaged in the rental, sale, or delivery of prerecorded 
video cassette tapes or similar audiovisual materials unlawful and provides an exclusionary 
rule to prohibit personally identifiable information otherwise obtained from being 
admissible as evidence in any court proceeding. Personally identifiable information is 
defined as "information that identifies a person as having requested or obtained specific 
video .material or services . . . ." 


b7E 


b7E 


b7E 


b7E 


Version Dated: 
October 15, 2011 


18-128 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 



UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide § 1 8 

a) (U) The disclosure to law enforcement of “personally identifiable information” is 
permitted only when the law enforcement agency: 

(i) (U) Has the written consent of the customer; 

(ii) (U) Obtains a search warrant issued under Rule 4 1 , FRCP or equivalent state 
warrant; or 

(iii) (U) Serves a grand jury subpoena; 

b) (U)l 


c) (U) This type of information was specifically not included in the definition of 
"personally identifiable information" to allow law enforcement to obtain information 
about individuals during routine investigations such as neighborhood investigations. 

d) (U//FOUO) The disclosure of “personally identifiable information” in a national 
security investigation may be compelled through use of the above legal processes or 
pursuant to a business records order issued under 50 U.S.C. § 1861. 

18.6.8.5 (U) Voluntary Emergency Disclosure 

18.6.8.5.1 (U) Scope 

(U//FOUO) ECPA protects subscriber and transactional information regarding 
communications from disclosure by providers of remote computing services or telephone or 
other electronic communication services to the public (remote computing services, telephone 
and other electronic communications services are hereafter collectively referred to as 
“electronic communications service providers” or “providers”). Generally, an NSL, grand jury 
subpoena, or other form of legal proc ess must be used to compel the communication service 
provider to disclose such information! ~~| 


(U//FOUOf 
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(U//FOUO)[ 




(U//FOUOJ 


(U//FOUO) The use of the 

needs to satisfy statutory annual Congress 

(U//FOUO)| 

is designed to captures all the information the FBI 
ional reporting requirements. 


18.6.8.5.2 (U) Duration of Approval 


(U) As authorized by statute (e.g., for as long as the emergency necessitating usage exists and 
only in those circumstances when it is impracticable to obtain other legal process such as a 
subpoena or NSL) and applicable court order or warrant. 

18.6.8.5.3 (U) Specific Procedures 

A ) (U//FOUO) Required Form:Y I 
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(U) Policy and procedures regarding cost reimbursement are described in the following: 

A) (U) Standardized payment procedures may be found at 

I 

B) (U) Cost Reimbursement Guidance can also be found in 18 U.S.C. § 2706 and in the OGC 
Library here . 

18.6.8.5.5 (U) Notice and Reporting Requirements 

18.6.8.5.6 (U) Reporting Voluntary Emergency disclosures 


(U) 18 U.S.C. § 2702(d) requires the Attorney General to report annually to Congress 
information pertaining to the receipt of voluntary disclosures of the contents of stored wire or 
electronic communications in an emergency under 18 U.S.C. § 2702(b)(8), specifically: 

A) (U) The number of accounts from which the FBI received voluntary emergency disclosures; 
and 


B) (U) A summary of the basis for the emergency disclosure in those investigations that were 
closed without the filing of criminal charges. 


(U) Thel 


Form will capture information required to meet these reporting requirement. 


1 8. 6.8.5. 7 (U) Roles/Responsibilities 


(U) Thef 


that hosts thef 


Jwill, when necessary, follow- 


up with e-mail notifications to the issuing employee to ensure that the information included in 
the report to DOJ (which it uses to prepare the required Congressional report) is current. It is 
the responsibility of the FBI employee to respond to these requests for information as soon as 
practicable but no later than ten (10) business days. Failure to do so may be considered 
“substantial non-compliance” pursuant to Section 3. 


(U) OGC/ILB is assigned the administrative responsibility to complete the following by 
December 3 1 of each year: 


A) (U) Tabulate the number of voluntary disclosures of stored contents received under the 
authority of 18 U.S.C. § 2702(b)(8) for the calendar year; 
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B) (U) Prepare a report summarizing the basis for disclosure in those instances in which the 
relevant investigation was closed without the filing of criminal charges; and 

C) (U) Submit the report to the General Counsel for review and submission to DOJ according to 
the statutory requirement for annual report by the Attorney General. 

18.6.8.6 (U) Other Applicable Policies 

(U) See the 
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18.6.9 (U) Investigative Method: Pen Registers and Trap/Trace Devices 

(PR/TT) 

18.6.9.1 (U) Summary 

(U) Pen register and trap and trace (PR/TT) devices enable the prospective collection of non- 
content traffic information associated with wire and electronic communications, such as: the 
phone numbers dialed from or to a particular telephone, including electronic communications; 
messages sent from or to a particular telephone; or the internet protocol (IP) address of 
communications on the Internet and other computer networks. 

18.6.9.2 (U) Application 

(U//FOUQ1 I b7E 


18.6.9.3 (U) Legal Authority 

(U) 18 U.S.C. §§ 3121 et seq. and 50 U.S.C. §§ 1842 et seq. regulate the use of PR/TT 
devices. PR/TT orders authorize the collection of phone number dialed from or to a particular 
telephone, IP addresses, port numbers and the “To” and “From” information from e-mail; they 
cannot intercept the content of a communication, such as telephone conversations or the 
words in the “subject line” or the body of an e-mail. 

18.6.9.4 (U) Definition of Investigative Method 

(U) A pen register device or process records or decodes dialing, routing, addressing or 
signaling information transmitted by an instrument or facility from which a wire or electronic 
communication is transmitted, provided that such information must not include the contents of 
any communication. See 18 U.S.C. § 3127(3). 

(U) A trap and trace device or process captures the incoming electronic or other impulses that 
identity the originating number or other dialing, routing, addressing or signaling information 
reasonably likely to identify the source of a wire or electronic communication, provided that 
such information does not include the contents of any communication. See 18 U.S.C. § 
3127(4). 

18.6.9.5 (U) Standards for Use and Approval Requirements for Investigative 
Method 

18.6.9.5.1 (U) Pen Register/Trap and Trace under FISA 

(U) Applications for authority to use a PR/TT device can be made to the FISC in national 
security investigations. See 50 U.S.C. § 1842. 
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18.6.9.5.1.1 (U) Legal Standard 

(U) Applications to the FISC are to be under oath and must include: 

A) (U) The identity of the federal officer making the application; and 

B) (U) A certification by the applicant that the information likely to be obtained is foreign 
intelligence information not concerning an USPER or is information that is relevant to an 
ongoing investigation to protect the United States against international terrorism or clandestine 
intelligence activities; and that such investigation, if of an USPER, is not conducted solely 
upon the basis of activities protected by the First Amendment to the Constitution. 

18.6.9.5.1.2 (U) Procedures 

(U//FOUO) Requests for opening or renewal of FISA PR/TT must be made using 


|will route the request to appropriate parties for their review and approval 
of the requesl | [ Routing a 

paper copy for signatures is not required. 

(U//FOUO) See| 

I | for additional guidance here . 

1 8.6.9.5.1 .3 (U) Emergency Authority— FISA: 50 U.S.C. § 1843 

(U//FOUO) Under the provisions of FISA, the Attorney General may grant Emergency 
Authority (EA) for PR/TT. Requests for Emergency Authority must be referred to the 
appropriate FBIHQ division. 

(U//FOUQ1 


A) (U) The Attorney General may authorize the installation and use of a PR/TT upon a 

determination that an emergency exists and that the factual basis exists for a court order. The 
FISC must be informed at the time of the authorization and an application for a court order 
must be made to the court as soon as practicable, but no more than seven (7) days after the 
authorization. If the court does not issue an order approving the use of a PR/TT, an 
emergency-authorized PR/TT use must terminate at the earliest of when the information 
sought is obtained, when the FISC denies the application, or seven (7) days after the Attorney 
General authorization is given. 


b7E 


b7E 


b7E 


Version Dated: 
October 16, 2013 


18-134 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 



UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide § 1 8 

B) (U) If the FISC denies the application after an emergency PR/TT device has been installed, no 
information collected as a result may be used in any manner, except with the approval of the 
Attorney General upon a showing that the information indicates a threat of death or serious 
bodily harm to any person. 

(U) Notwithstanding the foregoing, the President, acting through the Attorney General, 
may authorize the use of a PR/TT, without a court order, for a period not to exceed 15 
calendar days, following a declaration of war by Congress. See 50 U.S.C. § 1844. 

(U//FOUO) For an emergency authorization to use a PR/TT surveillance,! I 


| | at any time. 

18.6.9.5.1.4 (U) FISA Overcollection 

(U//FOUO) In accordance with Foreign Intelligence Surveillance Court (FISC) Rule of 
Procedure 15, information acquired outside of the scope of the FISA authorization 
(“FISA overcollection”) will no longer be sequestered with the FISC, absent 
extraordinary circumstances. Contact NSLB for further guidance regarding the handling 
of any FISA overcollection. 

18.6.9.5.2 (U) Criminal Pen Register/Trap and Trace under Title 18 

(U) Applications for the installation and use of a PR/TT device may be made to a “court of 
competent jurisdiction” — i.e., “any district court of the United States (including a magistrate 
judge of such a court) or any United States court of appeals having jurisdiction over the 
offense being investigated, or any court of general criminal jurisdiction of a State authorized 
by the law of that State to enter orders authorizing the use of a pen register or trap and trace 
device.” See 1 8 U.S.C. § 3 127(2). 

18.6.9.5.2.1 (U) Legal Standard 

(U) Applications for authorization to install and use a PR/TT device must include: 

A) (U) The identity of the attorney for the government or the state law enforcement or 
investigative officer making the application and the identity of the law enforcement agency 
conducting the investigation; and 

B) (U) A certification by the applicant that the information likely to be obtained is relevant to an 
ongoing criminal investigation being conducted by that agency. 

18.6.9.5.2.2 (U//FOUO) Procedures 

(U//FOUO) An SSA must approve a request for opening or renewal of PR/TT use prior to 
submission of the request to an attorney for the government. Before approving such a 
request, the SSA should consider of the following: 

A) (U//FOUO) The use of resources based on the investigative purpose set forth; 
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B) (U//FOUO) Whether there is sufficient factual basis for the certification to be made in the 
application (i.e., is the information likely to be obtained relevant to an ongoing criminal 
investigation); 

C) (U//FOUO) Whether the customer or subscriber has consented to the use of a PR/TT, see 18 
U.S.C.§ 3121(b)(3); or 

D) (U//FOUO) Whether the use of a PR/TT is the least intrusive method if reasonable based upon 
the circumstances of the investigation. 

(U//FOUO) A copy of the approving EC must be maintained in the pen register sub-file 
“PEN.” 

(U//FOUO) A PR/TT order is executable anywhere within the United States and, upon 
service, the order applies to any person or entity providing wire or electronic 
communication service in the United States whose assistance may facilitate the execution 
of the order. Whenever such an order is served on any person or entity not specifically 
named in the order, upon request of such person or entity, the attorney for the 
government or law enforcement or investigative officer that is serving the order must 
provide written or electronic certification that the order applies to the person or entity 
being served. 

(U//FOUO) Seel 

| for additional guidanc e here " 

18.6.9.5.2.3 (U) Emergency Authority— Criminal: 18 U.S.C. § 3125 

(U) The Attorney General, the Deputy Attorney General, the Associate Attorney General, 
any Assistant Attorney General, any acting Assistant Attorney General, or any Deputy 
Assistant Attorney General may specially designate any investigative or law enforcement 
officer to reasonably determine whether an emergency situation exists that requires the 
installation and use of a PR/TT device before an order authorizing such installation and 
use can, with due diligence, be obtained and there are grounds upon which an order could 
be entered authorizing the installation and use of a PR/TT. 

(U) An emergency situation as defined in this section involves: 

A) (U). Immediate danger of death or serious bodily injury to any person; 

B) (U) Conspiratorial activities characteristic of organized crime; 

C) (U) An immediate threat to a national security interest; or 

D) (U) An ongoing attack on a protected computer (as defined in 18 U.S.C. § 1030) that 
constitutes a crime punishable by a term of imprisonment greater than one year. 

(U) Only DOJ officials have the authority to authorize the emergency installation of a 
PR/TT. The FBI does not have this authority. If the DOJ authorizes the emergency 
installation of a PR/TT, the government has 48 hours after the installation to apply for 
and obtain a court order according to 1 8 U.S.C. § 3 123. It is a violation of law to fail to 
apply for and obtain a court order within this 48 hour period. Use of the PR/TT shall 
immediately terminate when the information sought is obtained, when the application for 
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a court order is denied, or if no court order has been obtained 48 hours after the 
installation of the PR/TT device in emergency situations. 



approval has been obtained, the DOJ attorney will advise the AUSA that the emergency 
use has been approved and that the law enforcement agency may proceed with the 
installation and use of the PR/TT. The DOJ attorney will send a verification 
memorandum, signed by the authorizing official, to the AUSA. The AUSA will include 
an authorization memorandum with the application for the court order approving the 
emergency use. 

(U//FOUO) If an emergency situation arises after regular business hours! 

I During regular business hours 


18.6.9.6 (U) Duration of Approval 

A) (U) FISA: The use of a PR/TT device may be authorized by the FISC for a period of time not 
to exceed 90 days in investigations targeting an USPER. Extensions may be granted for 
periods not to exceed 90 days upon re-application to the court. In investigations in which the 
applicant has certified that the information likely to be obtained is foreign intelligence 
information not concerning a U.S. person (USPER), an order or extension may be for a period 
of time not to exceed one year. 

B) (U) Criminal: The installation and use of a PR/TT device may be authorized by court order 
under 18 U.S.C. § 3 123 for a period not to exceed 60 days, which may be extended for 
additional 60-day periods. 

18.6.9.7 (U) Specific Procedures 

(U//FOUO) Prior to installing and using a PR/TT device (whether issued in a criminal or 
national security matter), the case agent must: 
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18.6.9.8 (U) Use of FISA Derived Information in Other Proceedings 

(U//FOUO) There are statutory (50 U.S.C. Sections 1806, 1825, and 1845) and Attorney 
General (AG) policy restrictions on the use of information derived from a FISA ELSUR, 
physical search, or PR/TT. These restrictions apply to and must be followed by anyone 
“who may seek to use or disclose FISA information in any trial, hearing, or other 
proceeding in or before any court, department, officer, agency, regulatory body, or other 

authority of the United States ” See DIOG Appendix E for the AG Memo, Revised 

Policy on the Use or Disclosure of FISA Information, dated 01-10-2008. The guidance in 
the AG’s Memo establishes notification/approval procedures which must b e strictly 

followed. Though not contained in the AG M emo. FBI policy requires that 

\ Questions concerning the FISA use policy or 
requests for assistance in obtaining FISA use authority from the AG should be directed to 
NSLB’s Classified Litigation Support Unit. 

(U//FOUO) The United States must, prior to the trial, hearing, or other proceeding or at a 
reasonable time prior to an effort to disclose or use that information or submit it into 
evidence, notify the “aggrieved person” [as defined in 50 U.S.C. Sections 1801(k), 
1821(2), or 1841(2)], and the court or other authority in which the information is to be 
disclosed or used, that the United States intends to disclose or use such information. See 
50 U.S.C. Sections 1806(c), 1825(d), and 1845(c). 

18.6.9.9 (U) Congressional Notice and Reporting Requirements 

18 . 6 . 9 . 9.1 (U) Criminal Pen Register/Trap and Trace- Annual Report 

(U) The Attorney General is required to make an annual report to Congress on the number of 
criminal PR/TT orders applied for by DOJ law enforcement agencies. See 18 U.S.C. § 3126. 
The report must include the following information: 

A) (U) The period of interceptions authorized by the order, and the number and duration of any 
extensions; 

B) (U) The offense specified in the order or application, or extension; 

C) (U) The number of investigations involved; 

D) (U) The number and nature of the facilities affected; and 
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E) (U) The identity, including the district, of the applying agency making the application and the 
person authorizing the order. 

(U//FOUO) DOJ, Criminal Division, OEO requires the FBI to provide quarterly reports on 
pen register usage. To satisfy DOJ data requirements and standardize and simplify field 
reporting, court-ordered pen register usage must be repor ted to FBIHQ |~ 

i vithin five (5) workdays after the 
expiration date of an original order and any extensions, or denial of an application for an 
order. For all criminal PR/TT orders or extensions issued on or after January 1, 2009, the 

These reporting requirements 

do not apply to PR/TT authorized pursuant to consent or under the provisions of FISA. 

18.6.9.9.2 (U) National Security Pen Registers and Trap and Trace -Semi-Annual 

Report 

(U) The Attorney General must inform the House Permanent Select Committee on 
Intelligence, Senate Select Committee on Intelligence, Committee of the Judiciary of the 
House Representatives, and Committee of the Judiciary of the Senate concerning all uses of 
PR/TT devices pursuant to 50 U.S.C. § 1846. This report is coordinated through DOJ NSD. A 
semi-annual report must be submitted that contains the following information: 

A) (U) The total number of applications made for orders approving the use of PR/TT devices; 

B) (U) The total number of such orders either granted, modified, or denied; and 

C) (U) The total number of PR/TT devices whose installation and use was authorized by the 
Attorney General on an emergency basis and the total number of subsequent orders approving 
or denying the installation and use of such PR/TT devices. 

18.6.9.10 (U) Post Cut-Through Dialed Digits (PCTDD) 

18.6.9.10.1 (U) Overview 

(U//FOUO) Telecommunication networks provide users the ability to engage in extended 
dialing and/or signaling (also known as "post cut-through dialed digits" of PCTDD), which in 
some circumstances are simply call-routing information and, in others, are call content. For 
example, non-content PCTDD may be generated when a party places a calling card, credit 
card, or collect call by first dialing a long-distance carrier access number and then, after the 
initial call is “cut through,” dialing the telephone number of the destination party. In other 
instances, PCTDD may represent call content, such as when a party calls an automated 
banking service and enters an account number, calls a pharmacy’s automated prescription 
refill service and enters prescription information, or enters a call-back number when prompted 
by a voice mail service. See United States Telecom_Assnj^Federal_Commu^^ 

Commission. 227 F.3d 450, 462 (D.C. Cir. 2000)| | 


(U//FOUO) The definition of both a pen register device and a trap and trace device provides 
that the information collected by these devices "shall not include the contents of any 
communication." See 18 U.S.C. § 3127(3) and (4). In addition, 18 U.S.C. § 3121(c) makes 
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explicit the requirement to "use technology reasonably available" that restricts the collection 
of information "so as not to include the contents of any wire or electronic communications." 
"Content" includes any information concerning the substance, purport, or meaning of a 
communication. See 18 U.S.C. § 2510(8). When the pen register definition is read in 
conjunction with the limitation provision, however, it suggests that although a PR/TT device 
may not be used for the express purpose of collecting content, the incidental collection of 
content may occur despite the use of "reasonably available" technology to minimize, to the 
extent feasible, any possible over collection of content while still allowing the device to 
collect all of the dialing and signaling information authorized. 

(U//FOUO) DOJ Policy In addition to this statut ory obligation, DOJ has issued a directive in 
| | to all DOJ agencies requiring that no 

affirmative investigative use may be made of PCTDD incidentally collected that constitutes 
content, except in cases of emergency — to prevent an immediate danger of death, serious 
physical injury, or harm to the national security. 

(U//FOUQ1 I 


18.6.9.10.2 (U) Collection of PCTDD 


(U//FOUO) 





a: 

(U//FOUOH 1 



B) 

(U//FOUO)T 1 



18.6.9.10.3 (U) Use of PCTDD 

fU//FOUOl 
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18.6.9.10.4 (U) What constitutes PCTDD content 

(U//FOUO) In applying the above, the term “content” is interpreted to mean “any information 
concerning the substance, purport, or meaning of a communication” as defined in 18 U.S.C. § 
2510. Questions concerning whether specific PCTDD are content as opposed to dialing, 
routing, addressing, or signaling information should be addressed to the CDC or OGC for 
coordination with DOJ as necessary. 

('U//FOUQ1 


18.6.9.11 (U//FOUO)[ 


(U//FOUO)f 


b7E 


based 


TfSee also guidanc e provided in the OTP Technology- 


18.6.9.11.1 (U//FOUO) To Locate a Known Phone Number 


A) (U//FOUO) Authority : A standard PR/TT order issued pursuant to 1 8 U.S.C. § 3 127 is 

adequate to authorize the use of this technology to determine the location of a known targeted 
phone, provided that the language authorizes FBI employees to install or cause to be installed 
and use a pen register device, without geographical limitation, at any time of day or night 
within (X) days from the date the order is signed, to record or decode dialing, routing, 
addressing, or signaling information transmitted by the “Subject Telephone.” Due to varying 
and often changing court interpretations of the requirements for obtaining cell site location 
information, agents contemplating legal process to obtain such information should consult as 
necessary with their CDC and/or AUSA for the legal requirements in their particular 
jurisdiction. The application and order should generally also request authority to compel 
disclosure of cell site location data on an ongoing basis under 18 U.S.C. § 2703(d) — or 
probable cause, if such is required by the particular district cou rt — as such information may 


assist in determining the general location of the targeted phonej 


B) (U//FOUOf 
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18.63.11.2 (U//FOUO) To Identify an Unknown Target Phone Number 
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A ) (U//FOUO)[ 


B HU//FOUOT 


18.6.9.11.3 (U) PR/TT Order Language 

(U) The language in the order should state that "the pen register will be implemented 
unobtrusively and with minimum interference with the services accorded to customers of 
such service." 

18.6.9.12 (U) Evidence Handling 

(U//FOUO) All ELSUR downloading, processing, and handling of original, derivative, and 
copies of original or derivative ELSUR evidence must be conducted by an ELSUR operations 
technician (EOT) or other designated employee (e.g. an agent who has successfully completed 
ELSUR training in Virtual Academy). ELSUR evidence must not be uploaded into l I 
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18 . 6.10 (U) Investigative Method: Mail Covers 

18.6.10.1 (U) Summary 

(U) A mail cover may be sought only in a Predicated Investigation when there are reasonable 
grounds to demonstrate that the mail cover is necessary to: (i) protect the national security; (ii) 
locate a fugitive; (iii) obtain evidence of the commission or attempted commission of a 
federal crime; or (iv) assist in the identification of property, proceeds or assets forfeitable 
because of a violation of criminal law. See 39 C.F.R. § 233.3(e)(2). 

(U)l I 



b7E 


b7E 


18.6.10.2 (U) Application 

(U//FOUQ1 ~ 


b7E 


18.6.10.3 (U) Legal Authority 

A) (U) Postal Service Regulation 39 C.F.R. § 233.3 is the sole authority and procedure for 
opening a mail cover and for processing, using and disclosing information obtained from a 
mail cover; 

B) (U) There is no Fourth Amendment protection for information on the outside of a piece of 
mail. See, e.g.. U.S. v. Choate. 576 F.2d 165, 174 (9 th Cir., 1978); and U.S. v. Huie. 593 F.2d 
14 (5 lh Cir., 1979); and 

C) (U) AGG-Dom, Part V.A.2. 

18.6.10.4 (U) Definition of Investigative Method 

(U) A mail cover is the non-consensual recording of any data appearing on the outside cover 
of any sealed or unsealed mail matter to obtain information in order to: 

A) (U) Protect the national security; 

B) (U) Locate a fugitive; 
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C) (U) Obtain evidence of commission or attempted commission of a federal crime; 

D) (U) Obtain evidence of a violation or attempted violation of a postal statute; or 

E) (U) Assist in the identification of property, proceeds or assets forfeitable under law. 

See 39 C.F.R. § 233.3(c)(1). 

(U) In this context, a “recording” means the transcription, photograph, photocopy, or other 
facsimile of the image of the outside cover, envelope, or wrappers of mailed matter. A 
warrant or court order is almost always required to obtain the contents of any class of mail, 
sealed or unsealed. 

18.6. 10.5 (U) Standard for Use and Approval Requirements for Investigative 

Method 

M 


(U//FOUO) National Security MaU Coven. 


(U//FOUOl 


(UZ/FOUQt Requited Fornu I I 


or view mailing address information 

on the DIOG webpage under the resource link. 

(U//FOUO) Criming ?/ Mail Cover j I 
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b7E 


(U//FOUO) Required Form : \~ | b7E 

(U//FOUO) Review and Approval of National Security or Criminal MsiL Cover Reguests : 

Approval of any mail cover request or extension is conditioned on the following criteria being 
met: 




regulations, a mail cover must not include matter mailed between the mail cover subject and 
the subject’s attorney, unless the attorney is also a subject under the investigation. 


G ) (U//FOUO)[ 


H ) (U//FOUOf 

I) (U//FOUO)f 
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(U) Emergency Reguests : When time is of the essence, the Chief Postal Inspector, or 
designee, may act upon an oral request to be confirmed by the requesting authority, in writing, 
within three calendar days. Information may be released prior to receipt of the written request 
only when the releasing official is satisfied that an emergency situation exists. See 39 C.F.R. § 
233.3(e)(3). 

(U) An “emergency situation” exists when the immediate release of information is required to 
prevent the loss of evidence or when there is a potential for immediate physical harm to 
persons or property. See 39 C.F.R. § 233.3(c)(10). 

18.6.10.6 (U) Duration of Approval 

A) (U) National Security Mail Covers : No national security mail cover may remain in force for 
longer than 120 continuous days unless personally approved for further extension by the Chief 
Postal Inspector or his/her designees at National Headquarters. See 39 C.F.R. § 233.3(g)(6). 

B) (U) Criminal Mail Covers Except Fugitives : A mail cover in a criminal investigation is 
limited to no more than 30 days, unless adequate justification is provided by the requesting 
authority. See 39 C.F.R. § 233.3(g)(5). Renewals may be granted for additional 30-day 
periods under the same conditions and procedures applicable to the original request. The 
requesting authority must provide a statement of the investigative benefit of the mail cover 
and anticipated benefits to be derived from the extension. 

C) (U) Fugitives : No mail cover instituted to locate a fugitive may remain in force for longer 
than 120 continuous days unless personally approved for further extension by the Chief Postal 
Inspector or his/her designees at National Headquarters. See 39 C.F.R. § 233.3(g)(6). 

D) (U) Exception for Indictinents and Information : Except for fugitive investigations, no mail 
cover may remain in force when an information has been filed or the subject has been indicted 
for the matter for which the mail cover has been requested. If the subject is under investigation 
for further criminal violations, or a mail cover is required to assist in the identification of 
property, proceeds or assets forfeitable because of a violati on of criminal law, a new mail 
cover order must be requested. See 39 C.F.R. § 233.3fgY7')| 


b7E 


18.6.10.7 (U) Storage of Mail Cover Information 

(U//FOUO) The Postal Regulation requires that physical storage of all reports issued pursuant 
to a mail cover request to be at the discretion of the Chief Postal Inspector. See 39 C.F.R. § 
233.3(h)(1). Accordingly, FBI employees must conduct a timely review of mail cover 
documents received from the USPS. A copy of the signed mail cover request and the signed 
transmittal letter must be maintained in the investigative file. 
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18.6.10.8 (U) Return of Mail Cover Information to USPS 



18.6.10.9 (U) Compliance and Monitoring 

(U//FOUO) FBI employees must conduct a timely review of mail cover information received 
from the USPS for any potential production of data beyond the scope of the requested mail 
cover (“overproduction”). Overproduced information from a mail cover must not be serialized 
into any FBI database or used in any manner. 
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18.6.11 (U) Investigative Method: Polygraph Examinations 

18.6.11.1 (U) Summary 

(U//FOUO) The polygraph examination is used in Predicated Investigations to: (i) aid in 
determining whether a person has pertinent knowledge of a particular matter under 
investigation or inquiry; (ii) aid in determining the truthfulness of statements made or 
information furnished by a subject, victim, witness, CHS, or an individual making allegations; 
and (iii) obtain information leading to the location of evidence, individuals or sites of offense. 


(U//FOUO) 



(U//FOUO) This policy does not limit other authorized uses of polygraph method outside o: 
Assessments or Predicated Investigations, such as the FBI’s responsibilities to conduct 
background checks and inquiries concerning applicants and employees under federal 
personnel security programs. 

18.6.11.2 (U) Application 

(U//FOUO)| " " 

f 

3. 


lot otherwise prohibited by AGG-Dom, Part III.B.2- 



b7E 


b7E 


18.6.11.3 (U) Legal Authority 

(U) AGG-Dom, Part V.A.6. 

18.6.11.4 (U) Standards for Use and Approval Requirements for Investigative 
Method 

(U//FOUO) An SSA may approve the use of a polygraph if: 

A) (U//FOUO) | 

B) (U//FOUO)! 

i n 

C) (U//FOUO j 

18.6.11.5 (U) Duration of Approval 

(U//FOUOj 
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18.6.11.6 (U) Specific Procedures 

(U//FOUO) An EC must be prepared requesting SSA approval for the polygraph. If an AUSA 
is assigned to the investigation, an FBI employee must confer with the USAO to discuss any 
prosecutorial issues prior to the administration of a polygraph. 


18.6.11.7 (U) Compliance and Monitoring 


(U//FOUO) All p 
investigative file. 

plygranhs conducted in Predicated Investigations must he rinonrnented in the 
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18.6.12 (U) Investigative Method: Trash Covers (Searches that Do Not 

Require a Warrantor Court Order) 

18.6.12.1 (U) Summary 

(U) The Fourth Amendment to the United States Constitution prevents the FBI from 
conducting unreasonable searches and seizures. It also generally requires a warrant be 
obtained if the search will intrude on a reasonable expectation of privacy. To qualify as a 
“reasonable expectation of privacy,” the individual must have an actual subjective expectation 
of privacy and society must be prepared to recognize that expectation as objectively 
reasonable. See Katz v. United States. 389 U.S. at 361. If an individual has a reasonable 
expectation of privacy, a warrant or order issued by a court of competent jurisdiction or an 
exception to the requirement for such a warrant or order is required before a search may be 
conducted. Physical searches of personal or real property may be conducted without a search 
warrant or court order if there is no reasonable expectation of privacy in the property or area. 
As a general matter, there is no reasonable expectation of privacy in areas that are exposed to 
public view or that are otherwise available to the public. 

(U//FOUO) Note: Consent Searches are authorized in Assessments, as well as in Predicated 
Investigations. 

(U) A reasonable expectation of privacy may be terminated by an individual abandoning 
property, setting trash at the edge of the curtilage or beyond for collection, or when a private 
party reveals the contents of a package. However, the AGG-Dom and FBI policy have 
restricted the use of “trash covers” to Predicated Investigations as set forth in this section. 


18.6.12.2 (U) Application 



18.6.12.3 (U) Legal Authority 

A) (U) AGG-Dom, Part V.A.3, 

B) (U) Fourth Amendment to the United States Constitution 

18.6.12.4 (U) Definition of Investigative Method 

1 8. 6.12.4.1 (U) Distinction between " Trash Covers" and Searches of Abandoned 

Property or Trash 

A) (U//FOUO) Trash Cover : The intentional search of a specific person’s trash (that is located at 
the place for collection), whether from a home or business, designed to find information 
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relevant to an ongoing investigation when no reasonable expectation of privacy exists. A trash 
cover is a targeted effort to gather information regarding a particular person or entity by 
reviewing that person or entity’s refuse. Generally, a trash cover is a planned in advance 
activity based upon information obtained that a specific trash container will contain evidence 
or intelligence of an investigative interest, and that such activity will occur over a specified 
period of time. 

B) (U//FOUO) Search o£Abandoned_ Property or Trash : A search of abandoned property or 
trash that has been placed in a publicly accessible garbage container is not a “trash cover” 
under the definition above. If an FBI employee observes an individual abandoning something, 
for example, in a publicly accessible garbage can, or observes possible evidence of a crime or 
something of intelligence value in a public trash receptacle, the FBI employee may recover the 
item(s) without having an Assessment or Predicated Investigation open at that time. 

18.6.12.4.2 (U) Determination of an Area of Curtilage Around a Home 

(U) Whether an area is curtilage around a home is determined by reference to four factors: (i) 
proximity of the area in question to the home; (ii) whether the area is within an enclosure 
surrounding the home; (iii) nature of the use to which the area is put; and (iv) steps taken to 
protect the area from observation by passers-by. 

(U) An area is curtilage if it is so intimately tied to the home itself that it should be placed 
under the home’s umbrella of Fourth Amendment protection. 

18.6.12.5 (U) Standards for Use and Approval Requirements for Investigative 

Method 

(U//FOUO) SSA approval is required for the use of this method. In Type 5 Assessments, prior 
to using this method, the employee must also consult with the CDC or OGC to determine 
whether a person has a reasonable expectation of privacy in the area to be searched and 
whether a search warrant is required. During Predicated Investigations, if there is a doubt as to 
whether a person has a reasonable expectation of privacy in the area to be searched, the 
employee must consult with the CDC or OGC to determine whether a search warrant is 
required. Use of this method must be documented in the investigative file. 
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18 . 6.13 (U) Investigative Method: Undercover Operations 

18;6.13.1 (U) Summary 

(U//FOUO] | 


(U//FOUO) Undercover operations must be conducted in conformity with The Attorney 
General 's Guidelines on Federal Bmeau of Investigation Undercover Operations (AGG- 
UCO) in investigations relating to activities in violation of federal criminal law that do not 
concern threats to the national security or foreign intelligence. In investigations that concern 
threats to the national security or foreign intelligence, undercover operations involving 
religious or political organizations must be reviewed and approved by FBI Headquarters, with 
participation by the NSD in the review process. (AGG-Dom, Part Y.A.7) Other undercover 
operations involving threats to the national security or foreign intelligence are reviewed and 
approved pursuant to FBI policy as described herein. 

(U//FOUO ) Applic ationl \ 


18.6.13.2 (U) Legal Authority 

A) (U) AGG-Dom, Part V.A.7 

B) (U) AGG-UCO 

18.6.13.3 (U) Definition of Investigative Method 
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C ) (U//FOUO! Undercover Operation :F 


18.6.13.3.1 (U) Distinction Between Sensitive Circumstance and Sensitive Investigative 

Matter 


b7E 


(U//FOUO) 


|in the AGG-UCO and for 

national security matters in the Natio nal Security Undercover Operations Policy 
Implementation Guide INSUCOPGl. I 1 


The detailed 

policy tor undercover operations is described in this section of the DIOG, the Undercover and 
Sensitive Operations Policy Implementation Guide (USOPG), the NSUCOPG, and the 
FBIHQ operational division PGs. 


18.6.13.4 (U//FOUO) Standards for Use and Approval Requirements for 
Investigative Method 

18.6.1 3.4. 1 (U) Standards for Use of Investiga tive Method 

(U//FOUO) An official considering approval or authorization of a proposed undercover 
application must weigh the risks and benefits of the operation, giving careful consideration to 
the following: 

A) (U//FOUO) The risks of personal injury to individuals, property damage, financial loss to 
persons or business, damage to reputation, or other harm to persons; 

B) (U//FOUO) The risk of civil liability or other loss to the government; 

C) (U//FOUO) The risk of invasion of privacy or interference with privileged or confidential 
relationships and any potential constitutional concerns or other legal concerns; 

D) (U//FOUO) The risk that individuals engaged in undercover operations may become involved 
in illegal conduct; and 

E) (U//FOUO) The suitability of government participation in the type of activity that is expected 
to occur during the operation. See AGG-UCO, Part IV.A. 
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18.6.13 .4.2 (U//FOUO) Approval Requirements for UCOs (investigations of violations 

OF FEDERAL CRIMINAL LAW THAT DO NOT CONCERN THREA TS TO NA TIONAL SECURITY 
OR FOREIGN INTELLIGENCE) 
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E) (U//FQU0f 


18.6.13.5 (U) Duration of Approval 

(UZ/FOUPII 


18.6.13.6 (U) Additional Guidance 


A) (U//FOUOJ 



B) (U//FOUO)| | 




C) (U//FOUOJ | 




18.6.13.7 (U) Compliance and Monitoring, and Reporting Requirements 

(U//FOU O) All UCO s must provide an| l using the 

to appropriate! ~| 
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18.7 (U) Authorized Investigative Methods in Full Investigations 

(U) See AGG-Dom, Part V.A.l 1-13. 

(U) In Full Investigations, to include Enterprise Investigations, the authorized investigative 
methods include: 

A) (U) The investigative methods authorized for Assessments. 

1) (U) Public information. (See Section 18.5.F) 

2) (U) Records or information - FBI and DOJ. (See Section 18.5.21 

3) (U) Records or information - Other federal, state, local, tribal, or foreign government 
agency. (See Section 18.5.31 

4) (U) On-line services and resources. (See Section 18.5.41 

5) (U) CHS use and recruitment. (See Section 18.5.51 

6) (U) Interview or request information from the public or private entities. (See Section 
18.5.61 

7) (U) Information voluntarily provided by governmental or private entities. (See Section 
18.5.71 

8) (U) Physical Surveillance (not requiring a court order). (See Section 18.5.81 

B) (U) The investigative methods authorized for Preliminary Investigations. 

1) (U) Consensual monitoring of communications, including electronic communications. (See 
Section 18.6.11 

2) (U) Intercepting the communications of a computer trespasser. (See Section 18.6.21 

3) (U) Closed-circuit television/video surveillance, direction finders, and other monitoring 
devices. (See Section 18.6.31 

4) (U) Administrative subpoenas. (See Section 18.6.41 

5) (U) Grand jury subpoenas. (See Section 18.6.51 

6) (U) National Security Letters. (See Section 18.6.61 

7) (U) FISA Order for business records. (See Section 18.6.71 

8) (U) Stored wire and electronic communications and transactional records. (See Section 
i 8.6. SI 20 

9) (U) Pen registers and trap/trace devices. (See Section 18.6.91 

10) (U) Mail covers. (See Section 18.6.101 

1 1) (U) Polygraph examinations. (See Section 18.6.1 11 

12) (U) Trash Covers (Searches that do not require a warrant or court order). (See Section 
18.6.121 

13) (U) Undercover operations. (See Section 18.6.131 

20 (U/ /FOUO) The use of Search Warrants to obtain this information in Preliminary Investigations is 
prohibited. (See DIOG Section 18.6.8.4.2.3) 
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C) (U) Searches - with a warrant or court order (reasonable expectation of privacy). (See Section 
18.7.1 below) 

D) (U) Electronic surveillance - Title III. (See Section 18.7.2 below) 

E) (U) Electronic surveillance - FISA and FISA Title VII (acquisition of foreign intelligence 
information). (See Section 18.7.3 below") 

(U//FOUO) Not all investigative methods are authorized while collecting foreign intelligence as 
part of a Full Investigation. See DIOG Section 9 for more information. 
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18. 7.1 (U) Investigative Method: Searches - With a Warrant or Court 

Order (reasonable expectation of privacy) 

(U) See AGG-Dom, Part V.A.12 and the Attorney General's Guidelines On Methods Of 
Obtaining Documentary Materials Held By Third Parties, Pursuant to Title II, Privacy Protection 
Act of 1980 (Pub. L. 96-440, Sec. 201 et seq.; 42 U.S.C. § 2000aa-l 1, et seq.). 

18.7.1.1 (U) Summary 

(U) The Fourth Amendment to the United States Constitution governs all searches and 
seizures by government agents. The Fourth Amendment contains two clauses. The first 
establishes the prohibition against unreasonable searches and seizures. The second provides 
that no warrant (authorizing a search or seizure) will be issued unless based on probable 
cause. Although an unlawful search may not preclude a prosecution, it can have serious 
consequences for the government. These include adverse publicity, civil liability against the 
employee or the government and the suppression of evidence from the illegal seizure. 

(U//FOUO) Application^ j b7E 


(U) A search is a government invasion of a person’s privacy. To qualify as reasonable 
expectation of privacy, the individual must have an actual subjective expectation of privacy 
and society must be prepared to recognize that expectation as objectively reasonable. See 
Katz v. United States. 389 U.S. at 361. The ability to conduct a physical search in an area or 
situation where an individual has a reasonable expectation of privacy requires a warrant or 
order issued by a court of competent jurisdiction or an exception to the requirement for such a 
warrant or order. The warrant or order must be based on probable cause. The United States 
Supreme Court defines probable cause to search as a “fair probability that contraband or 
evidence of a crime will be found in a particular place.” Illinois v. Gates. 462 U.S. 213, 238 
(1983). A government agent may conduct a search without a warrant based on an individual’s 
voluntary consent. A search based on exigent circumstances may also be conducted without a 
warrant, but the requirement for probable cause remains. 

(U//FOUO) There are special rules that must be followed prior to obtaining a search warrant 
that might intrude upon professional, confidential relationships. 

18.7.1.2 (U) Legal Authority 

(U) Searches conducted by the FBI must be in conformity with FRCP Rule 4 1 : FISA, 50 
U.S.C. §§ 1821-1829; orE.O. 12333 § 2.5. 
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18.7.1.3 (U) Definition of Investigative Method 

(U) Physical Search defined : A physical search constitutes any physical intrusion within the 
United States into premises or property (including examination of the interior of property by 
technical means) that is intended to result in the seizure, reproduction, inspection, or alteration 
of information, material, or property, under circumstances in which a person has a reasonable 
expectation of privacy. 

(U) A physical search requiring a warrant does not include: (i) electronic surveillance as 
defined in FISA or Title III; or (ii) the acquisition by the United States Government of foreign 
intelligence information from international foreign communications, or foreign intelligence 
activities conducted according to otherwise applicable federal law involving a foreign 
electronic communications system, using a means other than electronic surveillance as 
defined in FISA. 

18.7.1.3.1 (U) Requirement for Reasonableness 

(U) By the terms of the Fo urth Amendment, a search must be reasonable at its inception and 
reasonable in its execution. I 


b7E 


18.7.1.3.2 (U) Reasonable Expectation of Privacy 

(U) The right of privacy is a personal right, not a property concept. It safeguards whatever an 
individual reasonably expects to be private. The protection normally includes persons, 
residences, vehicles, other personal property, private conversations, private papers and 
records. The Supreme Court has determined that there is no reasonable expectation of privacy 
in certain areas or information. As a result, government intrusions into those areas do not 
constitute a search and, thus, do not have to meet the requirements of the Fourth Amendment. 
These areas include: (i) open fields; (ii) prison cells; (iii) public access areas; and (iv) vehicle 
identification numbers. The Supreme Court has also determined that certain governmental 
practices do not involve an intrusion into a reasonable expectation of privacy and, therefore, 
do not amount to a search. These practices include: (i) aerial surveillance conducted from 
navigable airspace; (ii) field test of suspected controlled substance; and (iii) odor detection. A 
reasonable expectation of privacy may be terminated by an individual taking steps to 
voluntarily relinquish the expectation of privacy, such as abandoning property or setting trash 
at the edge of the curtilage or beyond for collection. 

18. 7. 1.3.3 (U) Issuance of Search Warrant 

(U) Under FRCP Rule 41, upon the request of a federal law enforcement officer or an attorney 
for the government, a search warrant may be issued by: 

A) (U) a federal magistrate judge, or if none is reasonably available, a judge of a state court of 
record within the federal district, for a search of property or for a person within the district; 
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B) (U) a federal magistrate judge for a search of property or for a person either within or outside 
the district if the property or person is within the district when the warrant is sought but might 
move outside the district before the warrant is executed; 

C) (U) a federal magistrate judge in any district in which activities related to the terrorism may 
have occurred, for a search of property or for a person within or outside the district, in an 
investigation of domestic terrorism or international terrorism (as defined in 18 U.S.C. § 233 1); 
and 

D) (U) a magistrate with authority in the district to issue a warrant to install a tracking device. 

The warrant may authorize use of the device to track the movement of a person or property 
located within the district, outside, or both. 

(U) Physical searches related to a national security purpose may be authorized by the FISC. 

(50 U.S.C. §§ 1821-1829) 

18.7.1.3.4 (U) Property or Persons That May be Seized with a Warrant 

(U) A warrant may be issued to search for and seize any: (i) property that constitutes evidence 
of the commission of a criminal offense; (ii) contraband, the fruits of crime, or things 
otherwise criminally possessed; or (iii) property designed or intended for use or that is or has 
been used as the means of committing a criminal offense. In addition to a conventional search 
conducted following issuance of a warrant, examples of search warrants include: 

1 8.7. 1 .3.4. 1 (U) Anticipatory Warrants 

(U) As the name suggests, an anticipatory warrant differs from other search warrants in 
that it is not supported by probable cause to believe that contraband exists at the premises 
to be searched at the time the warrant is issued. Instead, an anticipatory search warrant is 
validly issued where there is probable cause to believe that a crime has been or is being 
committed, and that evidence of such crime will be found at the described location at the 
time of the search, but only after certain specified events transpire. These conditions 
precedent to the execution of an anticipatory warrant, sometimes referred to as 
"triggering events," are integral to its validity. Because probable cause for an anticipatory 
warrant is contingent on the occurrence of certain expected or "triggering" events, 
typically the future delivery, sale, or purchase of contraband, the judge making the 
probable cause determination must take into account the likelihood that the triggering 
event will occur on schedule and as predicted. Should these triggering events fail to 
materialize, the anticipatory warrant is void. 

1 8 .7. 1 .3 .4.2 (U) Sneak and Peek Search Warrants 

(U) A sneak and peek search warrant allows law enforcement agents to surreptitiously 

b7E 
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18.7.1.3.4.3 (U) Mail Openings 

(U) Mail in United States postal channels may be searched only pursuant to court order, 
or presidential authorization. United States Postal Service regulations governing such 
activities must be followed. A search of items that are being handled by individual 
couriers, or commercial courier companies, under circumstances in which there is a 
reasonable expectation of privacy, or have been sealed for deposit into postal channels, ' 
and that are discovered within properties or premises being searched, must be carried out 
according to unconsented FISA or FRCP Rule 41 physical search procedures. 

1 8.7. 1 .3 .4.4 (U) Compelled Disclosure of the Contents of Stored Wire or 
Electronic Communications 

(U) Contents in “electronic storage” (e.g., unopened e-mail/voice mail) require a search 
warrant. See 18 U.S.C. § 2703(a). A distinction is made between the contents of 
communications that are in electronic storage (e.g., unopened e-mail) for less than 180 
days and those in "electronic storage" for longer than 180 days, or those that are no 
longer in "electronic storage" (e.g., opened e-mail). In enacting the ECPA, Congress 
concluded that customers may not retain a "reasonable expectation of privacy" in 
information sent to network providers. However, the contents of an e-mail message that 
is unopened should nonetheless be protected by Fourth Amendment standards, similar to 
the contents of a regularly mailed letter. On the other hand, if the contents of an unopened 
message are kept beyond six months or stored on behalf of the customer after the e-mail 
has been received or opened, it should be treated the same as a business record in the 
hands of a third party, such as an accountant or attorney. In that case, the government 
may subpoena the records from the third party without running afoul of either the Fourth 
or Fifth Amendment. If a search warrant is used, it may be served on the provider without 
notice to the customer or subscriber. 

18 . 7 . 1 . 3 . 4 . 4.1 (U) Search Warrant 

(U//FOUO) Investigators can obtain the full contents of a network account with a search 
warrant. ECPA does not require the government to notify the customer or subscriber 
when it obtains information from a provider using a search warrant. Warrants issued 
under 18 U.S.C. § 2703 must either comply with FRCP Rule 41 or be an equivalent state 
warrant. Warrants issued pursuant to 18 U.S.C. § 2703 do not require personal service on 
the customer; the warrants are only be served on the electronic communication service or 
a remote computing service. FRCP Rule 41 requires a copy of the warrant be left with the 
provider, and a return and inventory be made. Federal courts have nationwide jurisdiction 
to issue these search warrants (see below). 

(U) With a search warrant issued based on probable cause pursuant to FRCP Rule 41 or 
an equivalent state warrant, the government may obtain: 
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A) (U) The contents of a wire or electronic communication that has been in electronic storage in 
an electronic communications system for one hundred and eighty days or less, and 

B) (U) Everything that can be obtained using a 18 U.S.C. § 2703(d) court order with notice. 

(U) In other words, every record and all of the stored contents of an account — including 
opened and unopened e-mail/voice mail — can be obtained with a search warrant based 
on probable cause pursuant to FRCP Rule 41. Moreover, because the warrant is issued by 
a neutral magistrate based on a finding of probable cause, obtaining a search warrant 
effectively insulates the process from challenge under the Fourth Amendment. 

18. 7.1.3.4.4.2 (U) Nationwide Scope 

(U) Search warrants under 18 U.S.C. § 2703(a) may be issued by a federal "court with 
jurisdiction over the offense under investigation," and may be executed outside the 
district of the issuing court for material responsive to the warrant. State courts may also 
issue warrants under 18 U.S.C. § 2703(a), but the statute does not give these warrants 
effect outside the issuing court’s territorial jurisdiction. As with any other FRCP Rule 41 
warrant, investigators must draft an affidavit and a proposed warrant that complies with 
FRCP Rule 41. 


18. 7.1.3.4.4.3 (V) Service of Process 

(U) 18 U.S.C. § 2703(a) search warrants are obtained just like any other FRCP Rule 41 
search warrant but are typically served on the provider and compel the provider to find 
and produce the information described in the warrant. ECPA expressly states that the 
presence of an officer is not required for service or execution of a search warrant issued 
pursuant to 18 U.S.C. § 2703(a). 

18. 7.1.3.4.4.4 (U) Court Order with Prior Notice to the Subscriber or 

Customer 

(U//FOUO) Investigators can obtain everything in a network account except for 
unopened e-mail or voice-mail stored with a provider for 180 days or less using a 18 
U.S.C. § 2703(d) court order with prior notice to the subscriber unless they have obtained 
authority for delayed notice pursuant to 18 U.S.C. § 2705. ECPA distinguishes between 
the contents of communications that are in "electronic storage" (e.g., unopened e-mail) 
for less than 1 80 days, and those that have been in "electronic storage" for longer or that 
are no longer in "electronic storage" (e.g., opened e-mail). 

(U) FBI employees who obtain a court order under 18 U.S.C. § 2703(d), and either give 
prior notice to the subscriber or comply with the delayed notice provisions of 18 U.S.C. § 
2705(a), may obtain: 

A) (U) “The contents of a wire or electronic communication that has been in electronic storage in 
an electronic communications system for more than one hundred and eighty days.” 18 U.S.C. 

§ 2703(a). 
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B) (U) "The contents of any wire or electronic communication" held by a provider of remote 
computing service "on behalf of . . . a subscriber or customer of such remote computing 
service," 18 U.S.C. §§ 2703(b)(l)(B)(ii), 2703 (b)(2); and 

C) (U) Everything that can be obtained using a 18 U.S.C. § 2703(d) court order without notice. 

(VI ~1 , 



(U) To order delayed notice, the court must find that "there is reason to believe that 
notification of the existence of the court order may... endanger the life or physical safety 
of an individual; [lead to] flight from prosecution; [lead to] destruction of or tampering 
with evidence; [lead to] intimidation of potential witnesses; or . . . otherwise seriously 
jeopardiz[e] an investigation or unduly delay[ ] a trial." 18 U.S.C. §§ 2705(a)(1)(A) and 
2705(a)(2). The applicant must satisfy this standard anew each time an extension of the 
delayed notice is sought. 

18.7.1.3.4.4.6 (U) Nationwide Scope 

(U) Federal court orders under 18 U.S.C. § 2703(d) have effect outside the district of the 
issuing court. Orders issued pursuant to 18 U.S.C. § 2703(d) may compel providers to 
disclose information even if the information is stored outside the district of the issuing 
court. See 18 U.S.C. § 2703(d) ("any court that is a court of competent jurisdiction" may 
issue a 18 U.S.C. § 2703[d] order); 18 U.S.C. § 271 1(3) (court of competent jurisdiction 
includes any federal court having jurisdiction over the offense being investigated without 
geographic limitation). 

(U) 18 U.S.C. § 2703(d) orders may also be issued by state courts. See 18 U.S.C. §§ 
2711(3), 3127(2)(B). Such orders issued by state courts, however, do not have effect 
outside the jurisdiction of the issuing state. See 18 U.S.C. §§ 271 1(3). 

18. 7.1.3.4.4. 7 (U) Court Order withoutPrior Notice to the Subscriber or 

Customer 

(U) A court order under 18 U.S.C. § 2703(d) may compel disclosure of: 
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A) (U) All "record(s) or other information pertaining to a subscriber to or customer of such 
service (not including the contents of communications [held by providers of electronic 
communications service and remote computing service])," and 

B) (U) Basic subscriber information that can be obtained using a subpoena without notice. 18 
U.S.C. § 2703(c)(1). 

18.7.1.4 (U) Approval Requirements for Investigative Method 

A) (U//FOUO) Search warrants issued, under authority of_ FRCPRule 41 : A warrant to search 
is issued by a federal magistrate (or a state court judge if a federal magistrate is not reasonably 
available). Coordination with the USAO or DOJ is required to obtain the warrant. 

B) (U//FOUO) FISA : In national security investigations, field office requests for FISA 
authorized physical searches must be submitted to FBIHQ using the F BI FISA Request Form . 

Field office requests for FISA approval are tracked through ] | This form should be b7E 

completed by the case agent. 

C) (U//FOUO) Sensitive Investigative Matters (SIM) : Notice to the appropriate FBIHQ 
operational Unit Chief and Section Chief is required if the matter under investigation is a 
sensitive investigative matter. Notice to DOJ is also required, as described in DIOG Section 
10 . 


18.7.1.5 (U) Duration of Approval 

(U) The duration for the execution of a warrant is established by the court order or warrant. 

18.7.1.6 (U) Specific Procedures 

18.7.1.6.1 (U) Obtaininga Warrant under FRCP Rule 41 

18.7.1.6.1.1 (U) Probable Cause 

' (U//FOUO) After receiving an affidavit or other information, a magistrate judge or a 
judge of a state court of record must issue the warrant if there is probable cause to search 
for and seize a person or property under FRCP Rule 41(c). Probable cause exists where 
“the facts and circumstances within the FBI employee’s knowledge, and of which they 
had reasonably trustworthy information are sufficient in themselves to warrant a person 
of reasonable caution in the belief that...” a crime has been or is being committed, and 
that sizable property can be found at the place or on the person to be searched. Probable 
cause is a reasonable belief grounded on facts. In judging whether a reasonable belief 
exists, the test is whether such a belief would be engendered in a prudent person with the 
officer’s training and experience. To establish probable cause, the affiant must 
demonstrate a basis for knowledge and belief that the facts are true and that there is 
probable cause to believe the items listed in the affidavit will be found at the place to be 
searched. 

18.7.1 .6. 1 .2 (U) Requesting a Warrant in the Presence of a Judge 

A) (U) Warrant on an Affidavit : When a federal law enforcement officer or an attorney for the 
government presents an affidavit in support of a warrant, the judge may require the affiant to 
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appear personally and may examine under oath the affiant and any witness the affiant 
produces. 

B) (U) Warrant on Sworn Testimony : The judge may wholly or partially dispense with a written 
affidavit and base a warrant on sworn testimony if doing so is reasonable under the 
circumstances. 

C) (U) Recording Testimony : Testimony taken in support of a warrant must be recorded by a 
court reporter or by a suitable recording device, and the judge must file the transcript or 
recording with the clerk, along with any affidavit. 

1 8.7. 1 .6. 1 .3 (U) Requesting a Warrant by Telephonic or Other Means 

A) (U) In General : A magistrate judge may issue a warrant based on information communicated 
by telephone or other appropriate means, including facsimile transmission. 

B) (U) Recording^ Testimony : Upon learning that an applicant is requesting a warrant, a 
magistrate judge must: (i) place under oath the applicant and any person on whose testimony 
the application is based; and (ii) make a verbatim record of the conversation with a suitable 
recording device, if available, or by a court reporter, or in writing. 

C) (U) Certifying Testimony : The magistrate judge must have any recording or court reporter's 
notes transcribed, certify the transcription's accuracy, and file a copy of the record and the 
transcription with the clerk. Any written verbatim record must be signed by the magistrate 
judge and filed with the clerk. 

D) (U) Suppression Umited : Absent a finding of bad faith, evidence obtained from a warrant 
issued under FRCP Rule 41(d)(3)(A) is not subject to suppression on the ground that issuing 
the warrant in that manner was unreasonable under the circumstances. 

18.7.1.6.1.4 (U) Issuing the Warrant 

(U) In general, the magistrate judge or a judge of a state court of record must issue the 
warrant to an officer authorized to execute it. The warrant must identify the person or 
property to be searched, identify any person or property to be seized, and designate the 
magistrate judge to whom it must be returned. The warrant must command the officer to: 
(i) execute the warrant within a specified time no longer than 14 days; (ii) execute the 
warrant during the daytime, unless the judge for good cause expressly authorizes 
execution at another time; and (iii) return the warrant to the magistrate judge designated 
in the warrant. 

1 8.7. 1 .6. 1 .5 (U) Warrant by Telephonic or Other Means 

(U) If a magistrate judge decides to proceed under FRCP Rule 41(d)(3)(A), the following 
additional procedures apply: 

A) (U) Preparing a Proposed Duplicate Onginal Wamutt : The applicant must prepare a 
"proposed duplicate original warrant" and must read or otherwise transmit the contents of that 
document verbatim to the magistrate judge. 

B) (U) Predating an Onginal Warrant : The magistrate judge must enter the contents of the 
proposed duplicate original warrant into an original warrant. 
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C) (U) Modifications : The magistrate judge may direct the applicant to modify the proposed 
duplicate original warrant, in that case, the judge must also modify the original warrant. 

D) (U) Signing the Original Warrant and the Duplicate Original Warrant : Upon determining, to 
issue the warrant, the magistrate judge must immediately sign the original warrant, enter on its 
face the exact time it is issued, and direct the applicant to sign the judge's name on the 
duplicate original warrant. 

1 8.7. 1 .6. 1 .6 (U) Written Operation Orders for Search Operations 

(U) The ADIC/SAC is responsible to ensure that careful and thorough planning is 
conducted for the successful execution of a high risk search operation involving a 
potentially dangerous situation or subject. The plan must be adapted to each situation and 
must include relevant details to enhance the safety and effectiveness of the Agents and 
officers involved in the search operation. The planning and execution of arrests, raids, 
and searches should be assigned to experienced Agents. All plans must be approved by 
ASACs or their designees. 

(U) Prior to conducting a search operation deemed a high risk, the Agent must prepare a 
written operation order (OPORDER) to include the five critical categories: Situation, 
Mission, Execution, Administration and Equipment, and Control and Communication 
. (SMEACV and must utilize the FD-888. FBI Arrest Plan Form f OPORDER! , 


situations where an FBI SWAT Team(s) or the Critical Incident Response Group’s 
(CIRG), Tactical Secti on is involved, the Operations Order Template must be used in lieu 
of the FD-88 8. See thel 

fr nd 1 I for more on the use of the SWAT 

Teams and CIRG, Tactical Section in high risk operations. 

(U) The written OPORDER must be presented in an oral briefing to all personnel 
involved in the execution of the search warrant prior to the operation. During the briefing, 
the briefing Agent should stress to the participants of the operation that the search has the 
potential to become dangerous. At the discretion of the field office approving official, the 
CDC/ADC may review the OPORDER (FD-888) and/or participate in providing the FBI 
deadly force- briefing to the search operation participants. 

(U) Exigent circumstances (i.e., emergency, pressing necessity requiring immediate 
action) may necessitate an oral briefing in lieu of the written OPORDER. The ASAC or 
designee must approve the use of an oral briefing in lieu of a written and approved 
OPORDER in exigent circumstances. An oral briefing must follow the requirements of a 
written OPORDER to address the SMEAC categories identified above. Documentation of 
the oral briefing must occur as soon as possible following the operation by preparing and 
filing the FD-888 or the Operations Order Template, whichever is appropriate for the 
situation. 

(U) The Agent may consider utilizing, and/or alerting local authorities to the planned 
search, if appropriate under the circumstances. Although the time of notification is left to 
the discretion of the Agent, he/she must consider the jurisdiction of local law 
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enforcement, its responsibility to its community and its need to be aware of law 
enforcement actions in its jurisdiction. 

1 8.7. 1 .6. 1 .7 (U) Executing and Returning the Warrant 

A) (U) Noting, the Time : The officer executing the warrant must enter on its face the exact date 
and time it is executed. 

B) (U) Inventory : An officer present during the execution of the warrant must prepare and verify 
an inventory of any property seized. The officer must do so in the presence of another officer 
and the person from whom, or from whose premises, the property was taken. If either one is 
not present, the officer must prepare and verify the inventory in the presence of at least one 
other credible person. 

C) (U) Receipt : The officer executing the warrant must: (i) give a copy of the warrant and a 
receipt for the property taken to the person from whom, or from whose premises, the property 
was taken; or (ii) leave a copy of the warrant and receipt at the place where the officer took the 
property. 

D) (U) Return : The officer executing the warrant must promptly return it — together with a copy 
of the inventory — to the magistrate judge designated on the warrant. The judge must, on 
request, give a copy of the inventory to the person from whom, or from whose premises, the 
property was taken and to the applicant for the warrant. 

1 8.7. 1 .6. 1 .8 18.7.1.6.1.8 (U) FORWARDING PAPERS TO THE CLERK 

(U) The magistrate judge to whom the warrant is returned must attach to the warrant a 
copy of the return, the inventory, and all other related papers and must deliver them to the 
clerk in the district where the property was seized. (FRCP Rule 41) 

1 8.7. 1 .6. 1 .9 18.7.1.6.1.9 (U) Warrant for a Tracking Device 

A) (U) Noting the Time : The officer executing a tracking device warrant must enter on it the 
exact date and time the device was installed and the period during which it was used. 

B) (U) Return : Within 10 calendar days after the use of the tracking device has ended, the officer 
executing the warrant must return it to the judge designated in the warrant. 

C) (U) Service : Within 10 calendar days after use of the tracking device has ended, the officer 
executing the warrant must serve a copy of the warrant on the person who was tracked. 

Service may be accomplished by delivering a copy to the person who, or whose property was 
tracked; or by leaving a copy at the person’s residence or usual place of abode with an 
individual of suitable age and discretion who resides at that location and by mailing a copy to 
the person’s last known address. Upon request of the government, the judge may delay notice 
as provided in FRCP Rule 41(f)(3). 

18.7.1.6.1.10 18.7.1.6.1.10 (U) Delayed Notice 

(U) Upon the government’s request, a magistrate judge — or if authorized by FRCP Rule 
41(b), a judge of a state court of record — may delay any notice required by FRCP Rule 
41 if the delay is authorized by statute. 
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§18 


18.7.1.6.2 (U) Obtaining a FISA Warrant 

(U) Applications for court-authorized physical search pursuant to FISA must be made by a 
federal officer in writing upon oath or affirmation and with the specific approval of the 
Attorney General. (See 50 U.S.C. § 1823). 

18.7.1.6.2.1 (U) Certificate by The Director of the FBI 

(U) Each FISA application must be accompanied by a Certification by the Director of the 
FBI or one of nine other individuals authorized by Congress or the President to provide 
such certifications that: the information being sought is foreign intelligence information; 
that a significant purpose of the search is to obtain foreign intelligence information; that 
such information cannot reasonably be obtained by normal investigative techniques; that 
the information sought is "foreign intelligence information" as defined by FISA. The 
certification must include a statement explaining the certifier's basis for the certification. 

(U) 50 U.S.C. § 1823 specifies the Assistant to the President for National Security 
Affairs; E.O. 12139 as amended by E.O. 13383 specifies the Director of the FBI, Deputy 
Director of the FBI, the Director of National Intelligence, the Principal Deputy Director 
of National Intelligence, the Director of the Central Intelligence Agency, the Secretary of 
State, the Deputy Secretary of State, the Secretary of Defense, and the Deputy Secretary 
of Defense as appropriate officials to make certifications required by FISA. The FBI 
Director has represented to Congress that the FBI deputy Director will only certify 
FISA’s when the FBI Director is not available to do so. 

1 8.7. 1 .6.2.2 (U) Length of Period of Authorization for FISC Orders 

(U) Generally, a FISC Order approving an unconsented physical search will specify the 
period of time during which physical searches are approved and provide that the 
government will be permitted the period of time necessary to achieve the purpose, or for 
90 days, whichever is less, except that authority may be: 

A) (U) For no more than one year for "Foreign Power" targets (establishments); or 

B) (U) For no more than 120 days for a non-USPER agent of a foreign power, with renewals for 
up to one. 

1 8.7. 1 .6.2.3 (U) Extension of Physical Search Authority 

(U//FOUO) An extension of physical search authority may be granted on the same basis 
as the original order upon a separate application for an extension and upon new findings 
made in the same manner as the original order. 

1 8.7. 1 .6.2.4 (U) Emergency FISA Authority 

A) (U) The Attorney General may authorize an emergency physical search under FISA when he 
reasonably makes a determination that an emergency situation exists that precludes advance 
FISA court review and approval, and there exists a factual predication for the issuance of a 
FISA Court Order. In such instances, a FISC judge must be informed by the Attorney General 
or his designee at the time of the authorization and an application according to FISA 
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requirements is submitted to the judge as soon as is practicable but not more than seven (7) 
days after the emergency authority has been approved by the Attorney General. 

B) (U) If a court order is denied after an emergency authorization has been initiated, no 
information gathered as a result of the search may be used in any manner except if with the 
approval of the Attorney General, the information indicates a threat of death or serious bodily 
harm to any person. 

C ) (U//FOUO) For an emergency FISA for physical search,! I 


1 8.7. 1 .6.2.5 (U) Special Circumstances 

(U) The President through the Attorney General may also authorize a physical search 
under FISA without a court order for periods of up to one year, if the Attorney General 
certifies that the search will be solely directed at premises, information, material, or 
property that is used exclusively by or under the open and exclusive control of a foreign 
power; there is no substantial likelihood that the physical search will involve the 
premises, information, material, or property of a United States person (USPER); and 
there are minimization procedures that have been reported to the court and Congress. The 
FBI's involvement in such approvals is usually in furtherance of activities pursued 
according to E.0. 12333. Copies of such certifications are to be transmitted to the FISA 
Court. See 50 U.S.C. § 1822[a], 

(U) Information concerning USPERs acquired through unconsented physical searches 
may only be used according to minimization procedures. See: 50 U.S.C. §§ 1824(d)(4) 
and 1825(a). 

18.7.1.6.2.6 (U) Required Notice 


(U) If an authorized search involves the premises of an USPER, and the Attorney General 
determines that there is no national security interest in continuing the secrecy of the 
search, the Attorney General must provide notice to the USPER that the premises was 
searched and the identification of any property seized, altered, or reproduced during the 
search. 


1 8.7. 1 .6.2.7 (U//FOUO) FISA Verification of Accuracy Procedures 



A) (U//FOUO) Each investigative file fo r which an application is or has been prepare d for 


submission to the FISC must include 


[This FISA 


must be used for copies of all of the supporting documentation relied nnon 


when making the certifications contained on thd 


b7E 


b7E 


b7E 


b7E 
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I h iust include: 


1) (U//FOUO] 

□ 



2) (U//FOUO)| 


1 


3) (U//FOUO) 





B) (U//FOUO)| I 


1 8.7. 1 .6.2.8 (U) Use of FISA Derived Information in Other Proceedings 


(U//FOUO) There are statutory (50 U.S.C. Sections 1806, 1825, and 1845) and Attorney 
General (AG) policy restrictions on the use of information derived from a FISA ELSUR, 
physical search, or PR/TT. These restrictions apply to and must be followed by anyone 
“who may seek to use or disclose FISA information in any trial, hearing, or other 
proceeding in or before any court, department, officer, agency, regulatory body, or other 

authority of the United States ” See DIOG Appendix E for the AG Memo, Revised 

Policy on the Use or Disclosure of FISA Information, dated 01-10-2008. The guidance in 
the AG’s Memo establishes notification/approval procedures which must be strictly 
followed. Though not contained in the AG Memo, FBI policy requires that! ~l 


(U//FOUO) The United States must, prior to the trial, hearing, or other proceeding or at a 
reasonable time prior to an effort to disclose or use that information or submit it into 
evidence, notify the “aggrieved person” [as defined in 50 U.S.C. Sections 1 80 1 (k), 
1821(2), or 1841(2)], and the court or other authority in which the information is to be 


b7D 

b7E 

b7E 

b7E 


b7E 
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disclosed or used, that the United States intends to disclose or use such information. See 
50 U.S.C. Sections 1806(c), 1825(d), and 1845(c). 


18.7.1.6.2.9 

(U//FOUOH 






(U//FOUO) Each investigative file for which an application is or has been nrenared f or 
submission to the FISC will include a sub-file to be labeled I 


jThis[ 


Jsub-file is to contain copies 


of all applications to and orders issued by the FISC for the cond uct of physical searches 
in the investigation. The following data must be included in this 


A) (U//FOUOY 
and 

B) (U//FOUOT 


18.7.1.6.2.10 (U//FOUO) FISA RENEWALS 


(U//FOUO)f 



b7E 


b7E 


b7E 

b7E 


b7E 


b7E 


b7E 


18 . 7 . 1 . 6 . 2 . 10.1 (U) Appealing the Decision of the Review Board 

(U//FOUO)! ~ 
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18.7.1.6.2.11 (U) Compliance and Monitoring for FISA 

(U//FOUO)! | b7E 

18.7.1.6.2.12 (U) FISA OVERCOLLECTION 

(U//FOUQ1 I b7E 

k ontact NSLB for further guidance regarding the handling of anv FISA 
overcollection. 
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19 (U) ARREST PROCEDURE POLICY 


19.1 (U) Arrest Warrants 

19.1.1 (U) Complaints 

(U) A complaint is a written statement of the facts necessary to establish probable cause to 
believe that an offense has been committed and that the defendant committed it. A complaint is 
presented under oath before a magistrate judge, who may issue an arrest warrant or a summons 
for the defendant if he/she finds the complaint establishes probable cause to believe the 
defendant committed the charged offense. 

19.1.2 (U) Arrest Warrants 

(U) Any justice, judge or magistrate judge of the United States has the authority to issue arrest 
warrants for any offense against the United States. In addition, if a federal judge is not available 
any justice of a state supreme court, mayor of a city, state or local judge, justice of the peace, or 
other magistrate of any state where the offender may be found can issue such warrants as long as 
he/she is neutral, detached and capable of deciding probable cause. Copies of warrants issued 
under this authority are returned to the court of the United States that has jurisdiction over the 
offense. 


1 9.1.3 (U) Jurisdiction 

(U) Federal rules do not limit the application for an arrest warrant to any specified district. 
Usually, an application for a warrant will be made in the district where the offense was 
committed, but it may also be issued by a magistrate judge in the district where the offender is 
located. 

19.1.4 (U) Person to be Arrested 

(U) An arrest warrant must contain the name of the defendant or, if his/her name is unknown, 
any name or description by which the defendant can be identified with reasonable certainty. 
There is no requirement to determine the defendant’s true name before a warrant can be issued. It 
is sufficient to develop facts which provide a reasonable belief that a particular individual is the 
offender. A warrant can be based on facts that provide a distinguishing physical description or 
describe the particular circumstances in which the defendant can be found. 
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19.2 (U) Arrest with Warrant 

19.2.1 (U) Policy 

(U) Whenever possible, an arrest warrant must be obtained prior to an arrest. SSAs may 
authorize Agents 21 to execute arrest warrants and, in extraordinary circumstances, FBIHQ should 
be notified in advance of the arrest. For example, SSAs should notify FBIHQ when the arrest 
may have a significant impact on an investigation in another field office or when the arrest is 
likely to cause widespread publicity due to the identity or status of the arrestee or the. nature of 
the crime. 

(U) Upon the execution of an arrest warrant, the apprehending field office/division must 
promptly enter a “locate” within NCIC. The 00 of the warrant must enter a “clear” within NCIC 
within 24 hours of the “locate.” See the NCIC Field Division Guide, Q145PG for detailed NCIC 
policy. 

19.2.2 (U) Prompt Execution 

(U) While there is no time limit on the execution of arrest warrants (unlike search warrants), as a 
general rule Agents should make the arrest without prolonged delay after obtaining the warrant. 

1 9.2.3 (U) Arrest Plans 

(U) The ADIC/SAC is responsible to ensure that careful and thorough planning is conducted for 
the successful execution of a high risk arrest operation involving a potentially dangerous 
situation or subject. The arrest plan must be adapted to each situation and must include relevant 
details to enhance the safety and effectiveness of the agents and officers involved in the search 
operation. The planning and execution of arrests, raids, and searches should be assigned to 
experienced Agents. All arrest plans must be approved by ASACs or their designees. 

(U) Prior to conducting an arrest operation deemed a high risk, the agent must prepare a written 
operation order (OPORDER) to include the five critical categories: Situation, Mission, 

Execution, Administration and Equipment, and Control and Communication (SMEAC), and 

must utilize the FD-888, FBI Arrest Plan Form 

|ln situations 

where an FBI SWAT Team(s) or the Critical Incident Response Group’s (CIRG), Tactical 
Section is involved, the Operations Order Template must be used in lieu of the FD-888. See the 

, 1 , M l 

| |for more on the use of the SWAT Teams and CIRG, Tactical Section in high 

risk operations. 

(U) The written OPORDER must be presented in an oral briefing to all personnel involved in the 
execution of the arrest warrant(s) prior to the operation. During the briefing, the briefing Agent 
should stress to the participants of the operation that the arrest(s) has the potential to become 


21 (U) The term "Agent" in the context of this section includes FBI Special Agents and other federal, state, 
tribal, or local law enforcement officers who have been deputized under either Title 18 or 21 of the United 
States Code and are working on behalf of or at the direction of the FBI, e.g. task force officer, JTTF, etc. 
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dangerous. At the discretion of the field office approving official, the CDC/ADC may review the 
OPORDER (FD-888) and/or participate in providing the FBI deadly force briefing to the arrest 
operation participants. 

(U) Exigent circumstances (i.e., emergency, pressing necessity requiring immediate action) may 
necessitate an oral briefing in lieu of the written OPORDER. The ASAC or designee must 
approve the use of an oral briefing in lieu of a written and approved OPORDER in exigent 
circumstances. An oral briefing must follow the requirements of a written OPORDER to address 
the SMEAC categories identified above. Documentation of the oral briefing must occur as soon 
as possible following the operation by preparing and filing the FD-888 or the Operations Order 
Template, whichever is appropriate for the situation. 

(U) The SSA may consider utilizing, and/or alerting local authorities to the planned arrest, if 
appropriate under the circumstances. Although the time of notification is left to the discretion of 
the SSA, he/she must consider the jurisdiction of local law enforcement, its responsibility to its 
community and its need to be aware of law enforcement actions in its jurisdiction. 

1 9.2.4 (U) Joint Arrests 

(U) An SSA may authorize a joint arrest with state and local authorities, United States Marshals 
Service (USMS), or other federal law enforcement agencies. In circumstances of joint arrests, the 
SAC remains responsible to ensure that there is a well-considered arrest plan. 

1 9.2.5 (U) Possession and Display of Warrant 

(U) If time permits, the arresting Agent should have the arrest warrant in his/her possession and 
show it to the defendant at the time of arrest. If the Agent does not have the warrant with him/her 
at the time of arrest, the Agent must inform the defendant of the offense(s) charged and that a 
warrant has been issued. The Agent must, at the defendant’s request, obtain the warrant and 
show it to the defendant as soon as practicable. 

19.3 (U) Arrest without Warrant 

1 9.3.1 (U) Federal Crimes 

(U) Whenever possible, SAC and USAO authority must be obtained before making a warrantless 
arrest. Agents are authorized to make warrantless arrests for any federal crime (felony or 
misdemeanor) committed in their presence. Agents also have authority to make warrantless 
felony arrests for a crime not committed in the presence of the Agent if there is probable cause to 
believe the person to be arrested committed a federal felony. A warrantless arrest must only be 
made when sound judgment indicates obtaining a warrant would unduly burden the investigation 
or substantially increase the potential for danger or escape. (See Non-Federal Crimes below) 

1 9.3.2 (U) Notifica tion to U.S. A ttorney 

(U) When a warrantless arrest has been made, the USAO must be contacted immediately for 
authorization to prosecute. 
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1 9.3.3 (U) Non-Federal Crimes 

(U) There is no federal statutory authority for Agents to intervene in non-federal (state) crimes. 
FBI policy permits certain types of non-federal arrests in exigent circumstances. 

(U) As a general rule, an Agent should only make an arrest for a state crime if a serious offense 
(felony or violent misdemeanor) has been committed in his or her presence and immediate action 
by the Agent is necessary to prevent escape, serious bodily injury, or destruction of property. 

(U) Agents are also authorized to arrest a person who is the subject of an FBI Predicated 
Investigation when a state or local arrest warrant for that person is outstanding, and the person is 
encountered during the investigation and would likely escape if not arrested. Similarly, an Agent 
working with state or local law enforcement officers who request assistance to apprehend a 
nonfederal fugitive who has been encountered during the course of a federal investigation is 
authorized to provide the requested assistance when intervention is otherwise permitted for a 
state crime as described in the preceding paragraph. 

(U) In some states, there is legislative authority for an Agent to intervene in certain types of state 
crimes as a peace officer rather than as a private citizen. Deputization as a state peace officer 
allows a federal Agent to make arrests for state offenses with the authority and immunities of a 
law enforcement officer of the state or one of its subdivisions. Of greater significance is whether 
intervention by an Agent in a particular nonfederal crime falls within the scope of employment. 
Agents who intervene in serious nonfederal crimes committed in their presence or who arrest a 
state fugitive under the circumstances previously described will normally be considered to be 
acting within the scope of their employment. While the determination to provide legal 
representation depends on the facts and circumstances of each circumstance, the DOJ, as a 
general rule, will provide legal representation to Agents who act in accordance with this policy. 

(U) It is important to note that the DOJ has indicated that efforts to enforce minor infractions of 
the law, such as shoplifting or traffic violations, are not generally considered to be within the 
scope of employment. Civil actions against federal personnel concerning acts which fall outside 
the scope of employment will not be removed to federal courts, and employees in such 
circumstances will not be eligible for legal representation provided for by the DOJ. An Agent's 
status with respect to civil liability in such circumstances will depend on a particular state's law, 
which may require an employee to defend himself/herself as an ordinary citizen. 

(U) See LHBSA Section 9 for a discussion of potential civil liability when making nonfederal 
arrests. 

1 9.3.4 (U) Adherence to FBI Policy 

(U) If any official in the USAO instructs an Agent to arrest or detain a subject in any manner 
contrary to FBI rules and regulations, the Agent must not comply with such instructions and 
must immediately inform the SSA. (See the special rules in Section D.13 below for the arrest of 
juveniles.) 
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19.4 (U) Prompt Appearance before Magistrate 

(U) When a federal arrest is made, the arrestee must be taken before a federal magistrate judge 
without unnecessary delay. If a federal magistrate judge is not available, the arrestee may be 
brought before a state or local judicial officer authorized by 18 U.S.C. § 3041 after consultation 
with the USAO. 

(U) Special Considerations for Unlawful Flight to Avoid Prosecution fUFAP - ) Arrests : If the 
arrestee was arrested on a warrant charging only a violation of UFAP, the arrestee can be 
transferred without unnecessary delay to the custody of the appropriate state or local authorities 
in the district of arrest. The USAO in the originating district will move promptly to dismiss the 
UFAP warrant. It is not necessary to wait until the UFAP warrant has been dismissed to release 
the subject to state or local authorities, but it is important for the Agent to ensure that the USAO 
dismisses the UFAP warrant promptly after the arrest. 

(U) If an Agent makes a warrantless arrest, a complaint must be filed setting forth the probable 
cause. The complaint is generally submitted when the arrestee is brought before the magistrate. 

A personal, telephonic, or electronic presentation to the magistrate of the facts setting forth the 
probable cause must occur within 48 hours of a warrantless arrest if the arrestee is detained and 
an initial appearance cannot be held within that 48-hour period. 

19 . 4.1 (U) Definition of Unnecessary Dela y 

(U) Rule 5 of the Federal Rules of Criminal Procedure requires the arresting agent to bring the 
accused before a federal magistrate judge without unnecessary delay. What constitutes 
“unnecessary delay” is determined in light of all the facts and circumstances. Confessions 
obtained from defendants during periods of unnecessary delay prior to initial appearance are 
generally inadmissible at trial. A voluntary confession that occurs within six (6) hours of arrest is 
admissible if the delay of the initial appearance would be the sole reason for suppression. The six 
hour period begins when the accused is arrested or taken into custody by federal law 
enforcement authorities on a federal charge and runs continuously. The six-hour safe harbor can 
be extended to include delays found by the trial judge to be reasonable considering the means of 
transportation and the distance to be traveled to the nearest available magistrate judge. Delay for 
the purpose of conducting interrogation will not be excused. Delays for many other reasons are 
justified and not grounds for suppression, particularly when there is no indication that the 
purpose of the delay was to extract a confession. For example, courts have found delays beyond 
six hours to be justified when attributable to the defendant’s need for medical treatment, his 
intoxication, the officers’ need to remain at the scene, the unavailability of a magistrate, and 
booking or other legitimate police procedures unrelated to interrogation. 

(U) To avoid the risk that a court will determine that delay beyond the safe-harbor period was 
“unnecessary” and suppress a confession elicited more than six (6) hours after arrest, Agents 
who want to continue or resume an interrogation after six (6) hours must seek a waiver of the 
right to prompt presentment from the accused. To continue an interrogation after six hours have 
elapsed, Agents must advise the suspect of his Rule 5 rights, and seek an affirmative waiver of 
those rights from him. The warning and waiver must be substantially in accord with this 
approved waiver language: 
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(U) “You have a right to be taken without unnecessary delay to court, where a judge will 
advise you of the charges against you and provide you with a copy of any affidavit the 
government has filed in support of these charges. The judge will also advise you of the 
rights I advised you of previously, namely, that you have a right to an attorney and to 
have an attorney appointed for you; that you have a right to remain silent and that any 
statement you make may be used against you. The judge will also tell you that you have a 
right to a preliminary hearing, at which the government will have to establish that the 
charges in the complaint are supported by probable cause. The judge will also tell you 
about the factors that will determine whether you can be released from custody prior to 
trial. Do you understand this right and are you willing to waive it and continue to talk to 
us?” 

(U) It is prudent to obtain a waiver of the right to prompt presentment in any circumstance when 
interrogation extends beyond the six-hour safe-harbor period. 

1 9.4.2 (U) Effect of Unnecessary Dela y 

(U) Incriminating statements obtained during any period of unnecessary delay after arrest and 
prior to the initial appearance before a magistrate are subject to suppression. 

19.4.3 (U) Necessary Delay 

(U) If the delay in bringing an arrested person before the magistrate judge is greater than six 
hours and a confession is obtained after six hours, the government has the burden of proving the 
delay was reasonable. Factors which could contribute to a reasonable delay are the means of 
transportation, the distance to the nearest available magistrate judge and the time and day of the 
week of the arrest. 

19.4.4 (U) Initial Processing 

(U) Following an arrest, the defendant should be brought to the nearest FBI office for 

fingerprinting, photographing, and an interview, where appropriate. Other law enforcement 
offices may be used for this purpose if FBI facilities are not reasonably available. This process 
generally should not exceed six hours, measured from the time of arrest to the time of arrival 
before the magistrate judge. 

1 9.4.5 (U) Collection ofDNA after Arrest or Detention 

(U) The Attorney General has directed the FBI to collect DNA samples from all arrestees, other 
than juveniles, and all non-U.S. persons (non-USPER) lawfully detained. A DNA sample should 
ordinarily be obtained during initial processing. FBI DNA collection kits should be used to 
collect a saliva sample from inside the person’s mouth. 

(U) There is no requirement to obtain a DNA sample from an individual who is arrested on an 
UFAP warrant when that individual will be turned over to the appropriate state/local agency with 
the expectation that the UFAP charge will be dismissed. A DNA sample should not be obtained 
from an individual arrested on a UFAP warrant when there is no expectation of federal 
prosecution. For example, when it is anticipated that the UFAP charge will be dismissed and the 
individual turned over to the appropriate state/local agency, no DNA sample should be obtained. 
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(U) A DNA sample may not be taken from a juvenile arrestee. A DNA sample may only be 
taken from a juvenile after he/she has been convicted of certain drug or violent offenses. 

(U) Federal law requires covered individuals to provide a DNA sample as a condition of pre-trial 
release and imposes criminal liability for failing to cooperate in the collection of the sample. 

(U) The law also authorizes “such means as are reasonably necessary to detain, restrain, and 
collect a DNA sample from an individual who refuses to cooperate in the collection of the 
sample.” If resistance is encountered, agents must seek to elicit the cooperation of the individual 
to collect the sample. If the individual continues to resist, agents must advise the USAO or the 
judge and seek a judicial order requiring the individual to cooperate. If the individual still 
continues to resist after the court order, agents may use reasonable force to overcome resistance 
and safely obtain the DNA sample. 

(U) For additional information on the process of collecting DNA samples from arrestees, see EC 
dated, 1 1/20/2009 from Laboratory to All Field Offices ('319T-HO-A1487667-LABL 

19.5 (U) Use of Force 

19.5.1 (U) Identification 

(U) An arresting Agent should identify himself/herself before effecting the arrest, in a clear, 
audible voice, as a Special Agent of the FBI and state his/her intention to arrest the subject. 

19.5.2 (U) Physical Force 

(U) Agents are permitted to use the amount of physical force reasonable and necessary to take 
custody and overcome all resistance of the arrestee, and to ensure the safety of the arresting 
Agents, the arrestee and others in the vicinity of the arrest. 

(U) See FBI Deadly Force Policy - DIOG Appendix F. 

(U) See FBI Less-Than-Lethal Force Policy- 05 17DPG 

19.5.3 (U) Restraining Devices 

(U) Temporary restraining devices, such as handcuffs, shackles and/or belts may be used to 
secure an arrestee. Use of such devices is lawful and proper, and Agents are expected to employ 
reasonable judgment under the circumstances in the use of these devices and to resolve any 
doubt in favor of their use. 

1 9.5.4 (U) Pregnant Arrestees 

(U) Within the standard operational procedures designed to ensure the successful completion of 
an operation and its immediate objectives, and while also guarding the safety of all involved, 
reasonable precautions and techniques should be employed when dealing with an arrestee 
reasonably believed to be pregnant to avoid harm to the fetus. This caution includes actions 
involving confrontation, apprehension, employing restraints, transporting and confining the 
individual, and respond promptly to needed or requested medical care. In particular, reasonable 
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care or precautions should be considered and used, if appropriate under the circumstances, when 
employing physical restraints that directly constrict the area of the fetus. 

19.6 (U) Manner of Entry 

19.6.1 (U) Knock and Announce 

(U) Agents are required by law to "knock and announce" their identity, authority and purpose, 
and demand to enter before entry is made to execute an arrest warrant. This is part of the 
"reasonableness" requirement of the Fourth Amendment. The announcement can be given by one 
Agent and need not be lengthy or elaborate but must convey to the person behind the door what 
is occurring. A loud announcement is essential and electronic devices designed to amplify the 
voice should be used where communication is anticipated to be difficult. The "knock and 
announce" requirement need not be complied with when the Agent executing the warrant has a 
reasonable suspicion of one or more of the following: 

A) (U) to "knock and announce" would cause the Agent and/or another to be placed in imminent 
peril of bodily harm; 

B) (U) to "knock and announce" would be a useless or futile gesture as the persons within the 
premises already know of the Agent's identity, authority, and purpose; 

C) (U) to "knock and announce" would cause the evidence sought under the warrant to be 
destroyed or removed; or 

D) (U) to "knock and announce" would permit the escape of the person the Agent seeks to arrest. 

1 9.6.2 (U) Suspect’s Premises 

(U) In order to lawfully enter a suspect's premises to effect an arrest, Agents must have either: (i) 
consent to enter, (ii) an emergency ("hot pursuit") justifying a warrantless entry, or (iii) an arrest 
warrant and probable cause to believe the suspect is in the premises. In determining whether a 
location is the suspect's premises, an apartment, hotel, motel or boardinghouse room becomes the 
principal residence of the person renting or leasing such premises. If the suspect is not named on 
the lease or rental agreement, the premises may still be considered the suspect's premises if the 
suspect occupies the premises jointly with another. 

19.6.3 (U) Third Party Premises, 

(U) In order to lawfully enter a third party's premises to arrest a suspect, Agents must have 
either: (i) consent to enter, (ii) an emergency ("hot pursuit") justifying a warrantless entry, or (iii) 
a search warrant for the third party premises describing the person to be arrested. For these 
purposes, a “third party premises” is any private premise which is not the principal residence of 
the person to be arrested. For example, a search warrant would be necessary if the arrestee is an 
overnight guest, casual visitor, or temporary caller at the premises of the third party. In order to 
make an entry to arrest, whether premised on an arrest warrant, search warrant, or exigent 
circumstances, the Agent must have probable cause to believe the suspect to be arrested is within 
the premises being entered. 
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19.6.4 (U) Exigent Circumstances 

(U) If an Agent has a reasonable belief that the subject will flee before a warrant can be obtained, 
or there is a substantial likelihood that the subject will dispose of evidence before a warrant can 
be obtained or there is increased danger to Agents or others if entry is delayed to obtain a 
warrant, exigent circumstances exist which may justify entry into premises to make a warrantless 
arrest or entry into third party premises without a search warrant to make an arrest. 

19.7 (U) Search Incident to Arrest 

(U) The authority to search incident to an arrest is an exception to the warrant requirement. 

Under this exception, an Agent may conduct a full and complete search of the person of the 
arrestee and the area within the arrestee’s “immediate control.” Immediate control means “the 
area from within which he might gain possession of a weapon or destructible evidence.” Once an 
arrestee has been secured and can no longer reach into the area to be searched, there is no longer 
justification for a warrantless search. The purpose for the exception is to protect the arresting 
Agent, prevent escape, and preserve any evidence in possession of the arrestee. The right to 
search flows from the fact of arrest, not the nature of the crime for which the arrest has been 
made. 

1 9. 7.1 (U) Prerequisite: Lawful Arrest 

(U) For a search incident to arrest to be lawful, the arrest itself must be lawful, i.e. probable 
cause must exist. Agents can maximize the likelihood that an arrest and search will survive a 
motion to suppress by obtaining an arrest warrant before effecting the arrest. As discussed below, 
entry into a subject’s premises to arrest may also affect the validity of a search incident to arrest. 

(U) Entry into Suspect's Premises: Any entry into premises in order to affect an arrest must be 
lawful. If entering the defendant's premises to effect the arrest, Agents must have either (i) 
consent to enter, (ii) an emergency ("hot pursuit"), or (iii) an arrest warrant and probable cause to 
believe that the defendant is inside the premises. 

1 9. 7.2 (U) Scope and Timing Requirement 

19.7.2.1 (U) Scope of Search 

(U) The Agent is entitled to search the person of the arrestee and the area within the arrestee's 
immediate control at the time of arrest for weapons, to prevent concealment or destruction of 
evidence, and to prevent concealment of any means of escape. The search may include any 
portable personal property in the arrestee's actual possession, such as clothing, purses, 
briefcases, grocery bags, etc. Items of personal property that are accessible to the arrestee, 
such as an unlocked desk drawer or unlocked suitcase, may be searched. Absent an 
emergency, inaccessible or locked items of personal property may not be searched. If there is 
probable cause to believe such items contain evidence, they may be seized, but the Agent 
must obtain a search warrant prior to opening the item. Once an arrestee has been secured and 
can no longer reach into the area to be searched, there is no longer justification for a 
warrantless search 


19-9 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 


Version Dated: 
October 15. 2011 


§19 


UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 


19.7.2.1.1 (U) Vehicles 

(U) The interior passenger compartment of a vehicle may be searched incident to a recent 
occupant’s arrest only if the arrestee is within reaching distance of the passenger compartment 
at the time of search or if it is reasonable to believe the vehicle contains evidence of the 
offense for which the person was arrested. Absent one of these factors, a warrantless search of 
an arrestee’s vehicle is unlawful. For example, a search of the vehicle incident to an arrest 
would not be permitted after the occupant has been removed, handcuffed, and placed in a 
nearby Bureau vehicle if the arrest was based on an outstanding arrest warrant for failure to 
appear. If a search of a vehicle incident to arrest can be done under these factors, the 
permissible scope can include unlocked or otherwise accessible containers, such as glove 
compartments, luggage, bags, clothing, etc. 

1 9. 7.2.1.2 (U) Protective Sweep 

(U) Agents may conduct a protective sweep of the areas immediately adjacent to the site of 
the arrest for the purpose of locating persons that may pose a threat to the safety of the Agents 
or others. Additionally, a protective sweep of other areas beyond those immediately adjacent 
to the site of the arrest may be conducted if the Agents have a reasonable suspicion, based on 
specific and articulable facts, that an individual who poses a danger to those present is in the 
area to be swept. Reasonable suspicion must be based on facts known to the Agents, such as 
noises in an attic or the at-large status of a dangerous associate. A protective sweep must be 
limited to a brief inspection of those areas within the premises in which a person could hide. 

If an Agent observes evidence in plain view while conducting a protective sweep, the 
evidence may be seized under the plain view doctrine. 

19.7.2.2 (U) Timing 

(U) A search incident to arrest must be made contemporaneous to the time and place of arrest 
and before the arrestee is removed from the area. A farther more thorough search of the 
arrestee at the FBI office or some other place to which the arrestee is transported is also 
permitted as a search incident to arrest. Additionally, Agents may make protective sweeps as 
described above at the time of arrest. 

1 9. 7.3 (U) Inventory of Personal Property 

(U) Items of personal property removed from a person who has been arrested and is to be 
incarcerated should be carefully inventoried and promptly, thoroughly searched by Agents prior 
to being stored for safekeeping. The inventory must include the contents of containers such as 
purses, shoulder bags, suitcases, etc. 

(U) If Agents have probable cause to believe evidence or contraband is in a locked container, a 
search warrant must be obtained absent emergency circumstances. This is the case because such 
a search is investigatory in nature. It also falls outside what is permitted as a search incident to 
arrest because the contents of a locked container are not immediately accessible to the arrestee. 

(U) Agents do not need a warrant to conduct an inventory search of a lawfully seized container 
removed from an arrestee’s person. Agents may not, however, conduct an inventory search 
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solely for investigative purposes. The inventory search must strictly adhere to standardized 
criteria and procedures for collection of property. 

19.8 (U) Medical Attention for Arrestees 

(U) If a person in FBI custody complains of sickness or ill health or if it is reasonably apparent to 
Agents that such a condition exists, arrangements should be made to afford such persons medical 
attention without delay. Agents must also be mindful of the health and well-being of any 
pregnant subject and make arrangements for medical attention when asked or when it is 
reasonably apparent that the subject or fetus needs medical attention. If the time required to 
obtain medical care may result in the passing of more than six hours between arrest and 
presentment, Agents must document the basis for and the receipt of any medical attention given 
to the arrestee. 

19.9 (U) Arrest of Foreign Nationals 

19.9.1 (U) Requirements Pertaining to Foreign Nationals 

A) (U) When a foreign national is arrested or detained, the arresting agent must advise him/her of 
the right to have his/her consular officials notified. 

B) (U) In some situations, the nearest consular officials must be notified of the arrest or detention 
of a foreign national, regardless of the national’s wishes. 

C) (U) Consular officials are entitled to access to their nationals in detention and are entitled to 
provide consular assistance. 

1 9. 9.2 (U) Steps to Follow When a Foreign National is Arrested or 

Detained 

(U) The arresting agent must determine the foreign national's country of citizenship. In the 
absence of other information, the arresting agent must assume that the country of citizenship is 
the country on whose passport or other travel documents the foreign national travels. 

(U) If the foreign national's country is not on the mandatory notification list below: 

A) (U) The arresting agent must promptly offer to notify the foreign national's consular officials 
of the arrest/detention. For a suggested statement to the foreign national, see Statement 1 
below. 

B) (U) If the foreign national asks that consular notification be given, the arresting Agent must 
promptly notify the nearest appropriate consular official of the foreign national's arrest. 

(U) If the foreign national's country is on the list of mandatory notification countries: 

A) (U) The arresting agent must promptly notify the nearest appropriate consular official of the 
arrest/detention. 

B) (U) The arresting agent must tell the foreign national that this notification will be made. A 
suggested statement to the foreign national is found at Statement 2 below. 
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(U) The arresting agent must keep a written record (EC or FD-302) in the investigative file that 
he/she provided appropriate notification to the arrestee and of the actions taken. 

Mandatory Notification Countries and Jurisdictions 


Algeria 

Guyana 

Saint Lucia 

Antigua and Barbuda 

Hong Kong 22 

Saint Vincent and the 
Grenadines 

Armenia 

Hungary 

Seychelles 

Azerbaijan 

Jamaica 

Sierra Leone 

Bahamas 

Kazakhstan 

Singapore 

Barbados 

Kiribati 

Slovakia 

Belarus 

Kuwait 

Tajikistan 

Belize 

Kyrgyzstan 

Tanzania 

Brunei 

Malaysia 

Tonga 

Bulgaria 

Malta 

Trinidad and Tobago 

China 23 

Mauritius 

Tunisia 

Costa Rica 

Moldova 

Turkmenistan 

Cyprus 

Mongolia 

Tuvalu 

Czech Republic 

Nigeria 

Ukraine 

Dominica 

Philippines 

United Kingdom 24 


22 (U) Hong Kong reverted to Chinese sovereignty on July 1, 1997, and is now officially referred to as the Hong 
Kong Special Administrative Region. Under paragraph 3(f) (2) of the March 25, 1997, U.S.-China Agreement 
on the Maintenance of the U.S. Consulate General in the Hong Kong Special Administrative Region, U.S. 
officials are required to notify Chinese officials of the arrest or detention of persons bearing Hong Kong 
passports in the same manner as is required for persons bearing Chinese passports- i.e., immediately and, in 
any event, within four days of the arrest or detention. 

23 (U) Notification is not mandatory in the case of persons who carry "Republic of China" passports issued by 
Taiwan. Such persons must be informed without delay, that the nearest office of the Taipei Economic and 
Cultural Representative Office ("TECRO"], the unofficial entity representing Taiwan's interests in the United 
States, can be notified at their request 
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Mandatory Notification Countries and Jurisdictions 


Fiji 

Poland (non-permanent residents 
only] 

U.S.S.R. 

Gambia 

Romania 

Uzbekistan 

Georgia 

Russia 

Zambia 

Ghana 

Saint Kitts and Nevis 

Zimbabwe 


Grenada 


19.9.3 (U) Suggested Statements to Arrested or Detained Foreign 

Nationals 

19.9.3.1 (U) Statement 1: When Consular Notification is at the Foreign National's 

Option 

(U) You are entitled to have us notify your country's consular representatives here in the 
United States that you have been arrested or detained. A consular official from your country 
may be able to help you obtain legal counsel and may contact your family and visit you in 
detention, among other things. If you want us to notify your country's consular officials, you 
can request notification now or at any time in the future. After your consular officials are 
notified, they may call or visit you. Do you want us to notify your country's consular 
officials? 


19.9.3.2 (U) Statement 2: When Consular Notification is Mandatory 

(U) Because of your nationality, we are required to notify your country's consular 
representatives here in the United States that you have been arrested or detained. After your 
consular officials are notified, they may call or visit you. You are not required to accept their 
assistance, but they may be able to help you obtain legal counsel and may contact your family 
and visit you in detention, among other things. We will notify your country's consular 
officials as soon as possible. 

19.9.4 (U) Diploma tic Immunity 

(U) Diplomatic representatives of foreign governments in the United States may not be arrested. 
Agents may not enter the office or dwelling of a diplomat or a person with diplomatic immunity 
for the purpose of making an arrest, search, or seizure. 


24 (UJ Mandatory notification is required for nationals of the British dependencies Anguilla, British Virgin 
Islands, Bermuda, Montserrat, and the Turks and Caicos Islands. Their nationals carry United Kingdom 
passports. 
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19.9.4.1 (U) Territorial Immunity 

(U) All embassies, legations, and consulates have territorial immunity. Consequently, no 
Agent may attempt to enter any embassy, legation, or consulate for the purpose of making an 
arrest, search or seizure. This territorial immunity extends to both the offices and residences 
of ambassadors and ministers, but only to the office of a consul. A consul’s residence does not 
enjoy territorial immunity. 

19.9.4.2 (U) Personal Immunity 

(U) Ambassadors and ministers, members of their staffs and domestic servants, and the 
immediate family members of a diplomatic officer have personal immunity, as do the 
immediate family members of the administrative and technical staff of a diplomatic mission. 
Consequently, no Agent should attempt to arrest or detain any such person. The personal 
immunity applies to the staffs, domestic servants and immediate family members, regardless 
of citizenship. Ordinarily, consuls do not have personal immunity from arrest on 
misdemeanor charges. If the arrest of a consul is contemplated, immediately notify FBIHQ by 
telephone or electronic communication before any action is taken so that an appropriate check 
can be made with the Department of State to determine whether the consul involved has any 
special immunity. 

19.10 (U) Arrest of News Media Members 

(U) Attorney General approval must be obtained prior to seeking an arrest warrant for or 
arresting a member of the news media who is suspected of committing any federal offense in the 
course of, or arising out of, the coverage or investigation of a news story, or while engaged in the 
performance of official news media duties. 

(U) Requests for the approval must be submitted to the AD of the operational FBIHQ division 
that is responsible for the investigative classification and the AD of the Office or Public Affairs 
(OPA) by an EC. The requesting EC must be reviewed by the CDC and approved by the SAC 
after coordination with the local USAO. The EC must set forth the facts believed to establish 
probable cause and the investigative justification for the arrest, consistent with the DOJ 
guidelines set forth in 28 C.F.R. § 50.10. 

(U) In emergency circumstances, an Agent may arrest a member of the news media without prior 
AG approval, if authorized by the SAC and the USAO. In such situations, the SAC must 
immediately notify the AD of the FBIHQ operational division, the AD of the OPA, and the 
General Counsel of the arrest, the emergency circumstances that justified proceeding without 
prior authorization and all of the information that would have been provided if prior 
authorization had been sought. The AD of the operational division must promptly notify the 
appropriate officials at DOJ as established in 28 C.F.R § 50.10. After these oral notifications 
have been made, the field office must provide written documentation to the FBIHQ operational 
AD as soon as practicable, but not more than 24 hours after the arrest. FBIHQ must provide 
appropriate written documentation to the DOJ approval authorities to whom oral notice was 
given. 
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19.11 (U) Arrest of Armed Forces Personnel 

(U) The Uniform Code of Military Justice authorizes any commanding officer exercising general 
court-martial jurisdiction to surrender military personnel under the officer's command to civil 
authority when the person has been charged with a civil offense. A request for surrender must be 
accompanied by: 

A) (U) A copy of the indictment, presentment, information, or warrant; 

B) (U) Sufficient information to identify the person sought as the person who allegedly 
committed the offense; and 

C) (U) A statement of the maximum sentence which may be imposed upon conviction. 

(U) Receipts for persons surrendered for civil prosecution should be signed by an official in the 
USAO, not by an FBI employee. 

19.12 (U) Arrest of Juveniles 

19.12.1 (U) Definition 

(U) A violation of 18 U.S.C. § 922(x)(2) or violation a federal law which would have been a 
crime, if committed by an adult, by a person who has not attained his/her 18th birthday is an act 
of juvenile delinquency. For the purpose of juvenile delinquency proceedings, a juvenile is a 
person who committed a crime before his/her 1 8 th birthday who has not attained his/her 21 st 
birthday at the time charges are commenced. 

19.12.2 (U) Arrest Procedures 

(U) Prearrest procedures applicable to adults (discussion with USAO, filing of complaint, 
issuance of warrant) also govern arrests of juveniles. After arrest, however, the Federal Juvenile 
Delinquency Act requires strict compliance with the following procedures: 

A) (U) Advice of Rights - The arresting Agent must immediately advise the arrested juvenile of 
his/her "legal rights" in language comprehensible to the juvenile. The rights found on the 
standard Form FD-395 meet this requirement. The arresting Agent may obtain a signature 
waiving his/her rights only if the Chief Division Counsel (CDC) or the USAO, based on the 
law of the circuit, has approved interrogation of the juvenile. 

B) (U) Notification to U.S. Attorney’s Office and Juvenile's Parents - The arresting Agent 
must immediately notify the USAO and the juvenile's parents, guardian, or custodian, that the 
juvenile has been arrested. The juvenile’s parents, guardian, or custodian must also be notified 
of the juvenile's rights (use the FD-395 for this purpose) and the nature of the alleged offense 
for which the juvenile was arrested. 

C) (U) Initial Appearance before Magistrate Judge - Subsequent to his/her arrest, the juvenile 
must be taken to a magistrate judge forthwith. 

D) (U) Record of Notification and Appearance - Because proof of timely notification to the 
juvenile’s parents and prompt appearance before the magistrate judge is essential. Agents must 
promptly prepare FD-302(s) documenting the time the following events occurred: 

1 ) (U) The j uvenile was arrested; 
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2) (U) The juvenile was advised of his/her rights; 

3) (U) The USAO was notified; 

4) (U) The juvenile’s parents, guardian, or custodian were notified of the arrest and of the 
juvenile’s rights; and 

5) (U) The juvenile was taken before a magistrate judge. 

E) (U) Interrogation and Interviews - Whether a juvenile may be interrogated between arrest 
for a federal offense and initial appearance before the magistrate judge depends on the law of 
the circuit in which the arrest occurs. If interrogation is not permitted in the circuit of arrest, 
information volunteered by the arrested juvenile concerning his/her guilt must be recorded in 
the Agent's FD-302. Clarifying questions may be asked if necessary to be certain what the 
juvenile intended to convey. The volunteered statement may be reduced to writing if such 
action does not delay the juvenile's appearance before the magistrate judge. A juvenile may 
always be questioned concerning the guilt of someone else, if such questioning does not delay 
bringing him/her before the magistrate judge. These rules apply only when the juvenile has 
been arrested for a federal offense. They do not apply when the juvenile is suspected of having 
committed a federal offense but is under arrest by state or local officers on a state or local 
charge. 

F) (U) Fingerprinting and Photographing - Agents may not fingerprint or photograph a 
juvenile unless he/she is to be prosecuted as an adult. Because it is not known at the time of 
arrest whether the juvenile will be prosecuted as an adult or a juvenile, Agents may not 
fingerprint or photograph a juvenile without permission of the magistrate judge. Following an 
adjudication of delinquency based on an offense which, if committed by an adult, would be a 
felony that is a crime of violence or a violation of 21 U.S.C. § 841 (manufacturing, 
distributing, dispensing of a controlled substance or possession with the intent to do same), § 
955 (possession of controlled substances on board vessels arriving in or departing the United 
States) or § 959 (manufacture or distribution of controlled substances for purpose of unlawful 
importation), the juvenile must be fingerprinted and photographed. Agents should coordinate 
fingerprinting and photographing with the USMS. 

G) (U) DNA Collection - Agents must not take DNA samples from juveniles at the time of arrest. 

H) (U) Press Releases - Neither the name nor picture of an arrested juvenile may be made public. 
Accordingly, the arrest of a juvenile may only be announced by a press release that does not 
contain identifying information. 
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20 (U) OTHER INVESTIGATIVE RESOURCES 


20.1 (U) Overview 


(U) Other investigative resources described below are available as specified in Assessments and 
Predicated Investigations. The investigative resources include: 

20.1.1 (U//FOUO f~ 

(U) See Section 20.2 below. 

20.1.2 (U//FOUO) \~ 

(U) See Section 20.3 below. 

20.1.3 (U//FOUO) Behavioral Analysis- Operational Behavioral Support 

Program 

(U) See Section 20.4 below. 

20.1.4 (U//FOUO) Sensitive Technical Equipment 

(U) See Section 20.5 below. 

20.2 (U//FOUO) f 

(U//FOUQ 1 


b7E 


b7E 


b7E 


b7E 


20.2.1 (U) Authorized Investigative Activity 

ru//Fouoil 


J . m 



1 

20.3 (U//FOUO^ 


Jp/fFOUOi 


\ 


7 
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b7E 


20.3.1 (U) Authorized Investigative Activity 

(U//FOUO) r 

IU//FOUQ1 


20.4 (U//FOUO) Operational Behavioral Support Program - CIRG's 
Behavioral Analysis Units (BAUs) and/or CD's Behavioral Analysis 
Program 

20.4.1 (U) Authorized Investigative Activity 

(U) The National Center for the Analysis of Violent Crime (NCAVC) manages and directs the 
FBFs operational behavioral support across all investigative programs. In addition, the 
NCAVC’s units provide operational and analytical support, without charge, to federal, state, 
local, tribal, foreign law enforcement, intelligence and security agencies involved in the 
investigation of unusual or repetitive violent crimes, communicated threats, terrorism, and other 
matters. The NCAVC also provides support through expertise and consultation in non-violent 
matters, such as national security, corruption, and white-collar crime investigations. See DIOG 
Section 12 for FD-999 documentation and other requirements for Assistance to Other Agencies. 

(U) Requests for NCAVC operational assistance should be made to the NCAVC Coordinator in 
the field office or to the NCAVC unit at Quantico. Requests for service can be coordinated 
through direct contact, telephone, email or Electronic Communication to the NCAVC. All FBI 
operational behavioral support requests must be coordinated and approved by the NCAVC. 

(U) The appropriate Legal Attache office (LEGAT) or the International Operations Division 
(IOD) must coordinate all requests from foreign law enforcement, intelligence and security 
agencies with NCAVC staff. NCAVC staff will assist the LEGAT or IOD preparation of an 
appropriate request for service and will facilitate the delivery of the service requested from the 
foreign agency. 

(U) For additional information regarding the services provided by NCAVC . 

20.5 (U//FOUO) Sensitive Technical Equipment 

(U//FOUO) Definition : Sensitive Technical Equipment (STE) is defined in the classified 
provisions in DIOG Appendix G. 

20.5.1 (U) Authorized Investigative Activity 

(Ul I 
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I Reler to the Extraterritorial Guidelines (see DIOG Section 131. appropriate 
Policy Implementation Guides, and OTD policy for additional information. 
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21 (U) INTELLIGENCE COLLECTION 



21.2 (U) FBI National Collection Requirements 

(U//FOUO) The FBIHQ DI establishes FBI national collection requirements after coordination 
with OGC, other FBIHQ operational divisions, and field offices. An FBI national collection 
requirement describes information needed by the FBI to: (i) identify or obtain information about 
potential targets of, or vulnerabilities to, Federal criminal activities or threats to the national 
security; or (ii) inform or facilitate intelligence analysis and planning pertinent to the FBI’s law 
enforcement or national security missions. 
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(U//FOUO) Before any investigative activity is conducted in order to respond to an FBI national 
collection requirement, an Assessment or Predicated Investigation must be opened or already 
open. An Assessment cannot be opened solely based upon an FBI national collection 
requirement. An authorized purpose (national security or criminal threat) and clearly defined 
objective(s) must exist prior to opening an Assessment. During an Assessment, the FBI is 

authorized t o collect against any FBI national collection requirement that is relevant to the 

Assessment.! 


(U//FOUQ1 I 


fUZ/FOUQ 


21.3 (U//FOUO) FBI Field Office Collection Requirements 

(U//FOUO) An FBI field office collection requirement describes information needed by the field 
to: (i) identify or obtain information about potential targets of or vulnerabilities to Federal 
criminal activities or threats to the national security; or (ii) inform or facilitate intelligence 
analysis and planning pertinent to the FBI’s law enforcement or national security missions. 

(U//FOUO) Before any investigative activity may be conducted to respond to an FBI field office 
collection requirement, an Assessment or Predicated Investigation must be opened or already 

open. An A ssessment cannot be opened solely based upon an FBI field office collection 

requirement 
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PREAMBLE 

These Guidelines are issued under the authority of the Attorney General as provided in 
sections 509, 510, 533, and 534 of title 28, United States Code, and Executive Order 12333. 
They apply to domestic investigative activities of the Federal Bureau of Investigation (FBI) and 
other activities as provided herein. 
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INTRODUCTION 

As the primary investigative agency of the federal government, the. Federal Bureau of 
Investigation (FBI) has the authority and responsibility to investigate all violations of federal law 
that are not exclusively assigned to another federal agency. The FBI is further vested by law and 
by Presidential directives with the primary role in carrying out investigations within the United 
States of threats to the national security. This includes the lead domestic role in investigating 
international terrorist threats to the United States, and in conducting counterintelligence activities 
to meet foreign entities’ espionage and intelligence efforts directed against the United States. 

The FBI is also vested with important functions in collecting foreign intelligence as a member 
agency of the U.S. Intelligence Community. The FBI accordingly plays crucial roles in the 
enforcement of federal law and the proper administration of justice in the United States, in the 
protection of the national security, and in obtaining information needed by the United States for 
the conduct of its foreign affairs. These roles reflect the wide range of the FBI’s current 
responsibilities and obligations, which require the FBI to be both an agency that effectively 
detects, investigates, and prevents crimes, and an agency that effectively protects the national 
security and collects intelligence. 

The general objective of these Guidelines is the full utilization of all authorities and 
investigative methods, consistent with the Constitution and laws of the United States, to protect 
the United States and its people from terrorism and other threats to the national security, to 
protect the United States and its people from victimization by all crimes in violation of federal 
law, and to further the foreign intelligence objectives of the United States. At the same time, it is 
axiomatic that the FBI must conduct its investigations and other activities in a lawful and 
reasonable manner that respects liberty and privacy and avoids unnecessary intrusions into the 
lives of law-abiding people. The purpose of these Guidelines, therefore, is to establish consistent 
policy in such matters. They will enable the FBI to perform its duties with effectiveness, 
certainty, and confidence, and will provide the American people with a firm assurance that the 
FBI is acting properly under the law. 

The issuance of these Guidelines represents the culmination of the historical evolution of 
the FBI and the policies governing its domestic operations subsequent to the September 11, 2001, 
terrorist attacks on the United States. Reflecting decisions and directives of the President and the 
Attorney General, inquiries and enactments of Congress, and the conclusions of national 
commissions, it was recognized that the FBI’s functions needed to be expanded and better 
integrated to meet contemporary realities: 

[Continuing coordination ... is necessary to optimize the FBI’s performance in 
both national security and criminal investigations .... [The] new reality requires first 
that the FBI and other agencies do a better job of gathering intelligence inside the United 
States, and second that we eliminate the remnants of the old “wall” between foreign ' 
intelligence and domestic law enforcement. Both tasks must be accomplished without 
sacrificing our domestic liberties and the rule of law, and both depend on building a very 
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different FBI from the one we had on September 10, 2001 . (Report of the Commission 
on the Intelligence Capabilities of the United States Regarding Weapons of Mass 
Destruction 466, 452 (2005).) 

In line with these objectives, the FBI has reorganized and reoriented its programs and 
missions, and the guidelines issued by the Attorney General for FBI operations have been 
extensively revised over the past several years. Nevertheless, the principal directives of the 
Attorney General governing the FBI’s conduct of criminal investigations, national security 
investigations, and foreign intelligence collection have persisted as separate documents' involving 
different standards and procedures for comparable activities. These Guidelines effect a more 
complete integration and harmonization of standards, thereby providing the FBI and other 
affected Justice Department components with clearer, more consistent, and more accessible 
guidance for their activities, and making available to the public in a single document the basic 
body of rules for the FBI’s domestic operations. 

These Guidelines also incorporate effective oversight measures involving many 
Department of Justice and FBI components, which have been adopted to ensure that all FBI 
activities are conducted in a manner consistent with law and policy. 

The broad operational areas addressed by these Guidelines are the FBI’s conduct of 
investigative and intelligence gathering activities, including cooperation and coordination with 
other components and agencies in such activities, and the intelligence analysis and pl annin g 
functions of the FBI. 

A. FBI RESPONSIBILITIES - FEDERAL CRIMES, THREATS TO THE 
NATIONAL SECURITY, FOREIGN INTELLIGENCE 

Part II of these Guidelines authorizes the FBI to carry out investigations to detect, obtain 
information about, or prevent or protect against federal crimes or threats to the national security 
or to collect foreign intelligence. The major subject areas of information gathering activities 
under these Guidelines - federal crimes, threats to the national security, and foreign intelligence 
- are not distinct, but rather overlap extensively. For example, an investigation relating to 
international terrorism will invariably crosscut these areas because international terrorism is 
included under these Guidelines’ definition of “threat to the national security,” because 
international terrorism subject to investigation within the United States usually involves criminal 
acts that violate federal law, and because information relating to international terrorism also falls 
within the definition of “foreign intelligence.” Likewise, counterintelligence activities relating to 
espionage are likely to concern matters that constitute threats to the national security, that 
implicate violations or potential violations of federal espionage laws, and that involve 
information falling under the definition of “foreign intelligence.” 

While some distinctions in the requirements and procedures for investigations are 
necessary in different. subject areas, the general design of these Guidelines is to take a uniform 
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approach wherever possible, thereby promoting certainty and consistency regarding the 
applicable standards and facilitating compliance with those standards. Hence, these Guidelines 
do not require that the FBI’s information gathering activities be differentially labeled as “criminal 
investigations,” “national security investigations,” or “foreign intelligence collections,” or that 
the categories of FBI personnel who carry out investigations be segregated from each other based 
on the subject areas in which they operate. Rather, all of the FBI’s legal authorities are- available 
for deployment in all cases to which they apply to protect the public from crimes and threats to 
the national security and to further the United States’ foreign intelligence objectives. In many 
cases, a single investigation will be supportable as an exercise of a number of these authorities - 
i.e., as an investigation of a federal crime or crimes, as an investigation of a threat to the national 
security, and/or as a collection of foreign intelligence. 

1. Federal Crimes 

The FBI has the authority to investigate all federal crimes that are not exclusively 
assigned to other agencies. In most ordinary criminal investigations, the immediate objectives 
include such matters as: determining whether a federal crime has occurred or is occurring, or if 
planning or preparation for such a crime is taking place; identifying, locating, and apprehending 
the perpetrators; and obtaining the evidence needed for prosecution. Hence, close cooperation 
and coordination with federal prosecutors in the United States Attorneys’ Offices and the Justice 
Department litigating divisions are essential both to ensure that agents have the investigative 
tools and legal advice at their disposal for which prosecutorial assistance or approval is needed, 
and to ensure that investigations are conducted in a manner that will lead to successful 
prosecution. Provisions in many parts of these Guidelines establish procedures and requirements 
for such coordination. 

2. Threats to the National Security 

The FBI’s authority to investigate threats to the national security derives from the 
executive order concerning U.S. intelligence activities, from delegations of functions by the 
Attorney General, and from various statutory sources. See, e.g., E.0. 12333; 50 U.S.C. 401 et 
seq.; 50 U.S.C. 1801 et seq. These Guidelines (Part VELS) specifically define threats to the 
national security to mean: international terrorism; espionage and other intelligence activities, 
sabotage, and assassination, conducted by, for, or on behalf of foreign powers, organizations, or 
persons; foreign computer intrusion; and other matters determined by the Attorney General, 
consistent with Executive Order 12333 or any successor order. 

Activities within the definition of “threat to the national security” that are subject to 
investigation under these Guidelines commonly involve violations (or potential violations) of 
federal criminal laws. Hence, investigations of such threats may constitute an exercise both of 
the FBI’s criminal investigation authority and of the FBI’s authority to investigate threats to the 
national security. As with criminal investigations generally, detecting and solving the crimes, 
and eventually arresting and prosecuting the perpetrators, are likely to be among the objectives of 
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investigations relating to threats to the national security. But these investigations also often serve 
important purposes outside the ambit of normal criminal investigation and prosecution, by 
providing the basis for, and informing decisions concerning, other measures needed to protect the 
national security. These measures may include, for example: excluding or removing persons 
involved in terrorism or espionage from the United States; recruitment of double agents; freezing 
assets of organizations that engage in or support terrorism; securing targets of terrorism or 
espionage; providing threat information and warnings to other federal, state, local, and private 
agencies and entities; diplomatic or military actions; and actions by other intelligence agencies to 
counter international terrorism or other national security threats. 

In line with this broad range of purposes, investigations of threats to the national security 
present special needs to coordinate with other Justice Department components, including 
particularly the Justice Department’s National Security Division, and to share information and 
cooperate with other agencies with national security responsibilities, including other agencies of 
the U.S. Intelligence Community, the Department of Homeland Security, and relevant White 
House (including National Security Council and Homeland Security Council) agencies and 
entities. Various provisions in these Guidelines establish procedures and requirements to 
facilitate such coordination. 

3. Foreign Intelligence 

As with the investigation of threats to the national security, the FBI’s authority to collect 
foreign intelligence derives from a mixture of administrative and statutory sources. See, e.g., 

E.0. 12333; 50 U.S.C. 401 et seq.; 50 U.S.C. 1801 et seq.; 28 U.S.C. 532 note (incorporating 
P.L. 108-458 §§ 2001-2003). These Guidelines (Part VUE) define foreign intelligence to mean 
“information relating to the capabilities, intentions, or activities of foreign governments or 
elements thereof, foreign organizations or foreign persons, or international terrorists.” 

The FBI’s foreign intelligence collection activities have been expanded by legislative and 
administrative reforms subsequent to the September 11, 2001, terrorist attacks, reflecting the 
FBI’s role as the primary collector of foreign intelligence within the United States, and the 
recognized imperative that the United States’ foreign intelligence collection activities become 
more flexible, more proactive, and more efficient in order to protect the homeland and adequately 
inform the United States’ crucial decisions in its dealings with the rest of the world: 

The collection of information is the foundation of everything that the Intelligence 
Community does. While successful collection cannot ensure a good analytical product, 
the failure to collect information . . . turns analysis into guesswork. And as our review 
demonstrates, the Intelligence Community’s human and technical intelligence collection 
agencies have collected far too little information on many of the issues we care about 
most. (Report of the Commission on the Intelligence Capabilities of the United States 
Regarding Weapons of Mass Destruction 351 (2005).) 
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These Guidelines accordingly provide standards and procedures for the FBI’s foreign intelligence 
collection activities that meet current needs and realities and optimize the FBI’s ability to 
discharge its foreign intelligence collection functions. 

The authority to collect foreign intelligence extends the sphere of the FBI’s information 
gathering activities beyond federal crimes and threats to the national security, and permits the 
FBI to seek information regarding a broader range of matters relating to foreign powers, 
organizations, or persons that may be of interest to the conduct of the United States’ foreign 
affairs. The FBI’s role is central to the effective collection of foreign intelligence within the 
United States because the authorized domestic activities of other intelligence agencies are more 
constrained than those of the FBI under applicable statutes and Executive Order 12333. In 
collecting foreign intelligence, the FBI will generally be guided by nationally-determined 
intelligence requirements, including the National Intelligence Priorities Framework and the 
National HUMINT Collection Directives, or any successor directives issued under the authority 
of the Director of National Intelligence (DNT). As provided in Part VII.F of these Guidelines, 
foreign intelligence requirements may also be established by the President or Intelligence 
Community officials designated by the President, and by the Attorney General, the Deputy 
Attorney General, or an official designated by the Attorney General. 

The general guidance of the FBI’s foreign intelligence collection activities by DNI- 
authorized requirements does not, however, limit the FBI’s authority to conduct investigations 
supportable on the basis of its other authorities - to investigate federal crimes and threats to the 
national security - in areas in which the information sought also falls under the definition of 
foreign intelligence. The FBI conducts investigations of federal crimes and threats to the 
national security based on priorities and strategic objectives set by the Department of Justice and 
■the FBI, independent of DNI-established foreign intelligence collection requirements. 

Since the authority to collect foreign intelligence enables the FBI to obtain information 
pertinent to the United States’ conduct of its foreign affairs, even if that information is not related 
to criminal activity or threats to the national security, the information so gathered may concern 
lawful activities. The FBI should accordingly operate openly and consensually with U.S. persons 
to the extent practicable when collecting foreign intelligence that does not concern criminal 
activities or threats to the national security. 

B. THE FBI AS AN INTELLIGENCE AGENCY 

The FBI is an intelligence agency as well as a law enforcement agency. Its basic 
functions accordingly extend beyond limited investigations of discrete matters, and include 
broader analytic and planning functions. The FBI’s responsibilities in this area derive from 
various administrative and statutory sources. See, e.g., E.0. 12333; 28 U.S.C. 532 note 
(incorporating P.L. 108-458 §§ 2001-2003) and 534 note (incorporating P.L. 109-162 § 1107). 
Enhancement of the FBI’s intelligence analysis capabilities and functions has consistently been 
recognized as a key priority in the legislative and administrative reform efforts following the 
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September 11, 2001, terrorist attacks: 

[Counterterrorism] strategy should . . . encompass specific efforts to . . . enhance the 

depth and quality of domestic intelligence collection and analysis [T]he FBI should 

strengthen and improve its domestic [intelligence] capability as fully and expeditiously as 
possible by immediately instituting measures to . . . significantly improve strategic 

analytical capabilities (Joint Inquiry into Intelligence Community Activities Before 

and After the Terrorist Attacks of September 1 1, 2001, S. Rep. No. 351 & H.R. Rep. No. 
792, 107th Cong., 2d Sess. 4-7 (2002) (errata print).) 

A “smart” government would integrate all sources of information to see the enemy as a 
whole. Integrated all-source analysis should also inform and shape strategies to collect 

more intelligence The importance of integrated, all-source analysis cannot be 

overstated. Without it, it is not possible to “connect the dots.” (Final Report of the 
National Commission on Terrorist Attacks Upon the United States 401, 408 (2004).) 

Part IV of these Guidelines accordingly authorizes the FBI to engage in intelligence 
analysis and planning, drawing on all lawful sources of information. The functions authorized 
under that Part include: (i) development of overviews and analyses concerning threats to and 
vulnerabilities of the United States and its interests, (ii) research and analysis to produce reports 
and assessments concerning matters relevant to investigative activities or other authorized FBI 
activities, and (iii) the operation of intelligence systems that facilitate and support investigations 
through the compilation and analysis of data and information on an ongoing basis. 

C. OVERSIGHT 

The activities authorized by these Guidelines must be conducted in a manner consistent 
with all applicable laws, regulations, and policies, including those protecting privacy and civil 
liberties. The Justice Department’s National Security Division and the FBI’s Inspection 
Division, Office of General Counsel, and Office of Integrity and Compliance, along with other 
components, share the responsibility to ensure that the Department meets these goals with respect 
to national security and foreign intelligence matters. In particular, the National Security 
Division’s Oversight Section, in conjunction with the FBI’s Office of General Counsel, is 
responsible for conducting regular reviews of all aspects of FBI national security and foreign 
intelligence activities. These reviews, conducted at FBI field offices and headquarter units, 
broadly examine such activities for compliance with these Guidelines and other applicable 
requirements. 

■i; 

Various features of these Guidelines facilitate the National Security Division’s oversight 
functions. Relevant requirements and provisions include: (i) required notification by the FBI to 
the National Security Division concerning full investigations that involve foreign intelligence 
collection or investigation of United States persons in relation to threats of the national security, 
(ii) annual reports by the FBI to the National Security Division concerning the FBI’s foreign 
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intelligence collection program, including information on the scope and nature of foreign 
intelligence collection activities in each FBI field office, and (iii) access by the National Security 
Division to information obtained by the FBI through national security or foreign intelligence 
activities and general authority for the Assistant Attorney General for National Security to obtain 
reports from the FBI concerning these activities. 

Pursuant to these Guidelines, other Attorney General guidelines, and institutional 
assignments of responsibility within the Justice Department, additional Department components 
- including the Criminal Division, the United States Attorneys’ Offices, and the Office of 
Privacy and Civil Liberties - are involved in the common endeavor with the FBI of ensuring that 
the activities of all Department components are lawful, appropriate, and ethical as well as 
effective. Examples include the involvement of both FBI and prosecutorial personnel in the 
review of undercover operations involving sensitive circumstances, notice requirements for 
investigations involving sensitive investigative matters (as defined in Part VII.N of these 
Guidelines), and notice and oversight provisions for enterprise investigations, which may involve 
a broad examination of groups implicated in the gravest criminal and national security threats. 
These requirements and procedures help to ensure that the rule of law is respected in the 
Department’s activities and that public confidence is maintained in these activities. 
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I. GENERAL AUTHORITIES AND PRINCIPLES 

A. SCOPE 

These Guidelines apply to investigative activities conducted by the FBI within the United 
States or outside the territories of all countries. They do not apply to investigative 
activities of the FBI in foreign countries, which are governed by the Attorney General’s 
Guidelines for Extraterritorial FBI Operations. 

B. GENERAL AUTHORITIES 

1 . The FBI is authorized to conduct investigations to detect, obtain information 
about, and prevent and protect against federal crimes and threats to the national 
■ security and to collect foreign intelligence, as provided in Part II of these 
Guidelines. 

2. The FBI is authorized to provide investigative assistance to other federal agencies, 
state, local, or tribal agencies, and foreign agencies as provided in Part IH of these 
Guidelines. 

3. The FBI is authorized to conduct intelligence analysis and planning as provided in 
Part IV of these Guidelines. 

4. The FBI is authorized to retain and share information obtained pursuant to these 
Guidelines as provided in Part VI of these Guidelines. 

C. USE OF AUTHORITIES AND METHODS 

1. Protection of the United States and Its People 

The FBI shall fully utilize the authorities provided and the methods authorized by 
these Guidelines to protect the United States and its people from crimes in 
violation of federal law and threats to the national security, and to further the 
foreign intelligence objectives of the United States. 

2. Choice of Methods 

a. The conduct of investigations and other activities authorized by these 

Guidelines may present choices between the use of different investigative 
methods that are each operationally sound and effective, but that are more 
or less intrusive, considering such factors as the effect on the privacy and 
civil liberties of individuals and potential damage to reputation. The least 
intrusive method feasible is to be used in such situations. It is recognized, 
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however, that the choice of methods is a matter of judgment. The FBI 
shall not hesitate to use any lawful method consistent with these 
Guidelines, even if intrusive, where the degree of intrusiveness is 
warranted in light of the seriousness of a criminal or national security 
threat or the strength of the information indicating its existence, or in light 
of the importance of foreign intelligence sought to the United States’ 
interests. This point is to be particularly observed in investigations 
relating to- terrorism. 

b. United States persons shall be dealt with openly and consensually to the 
extent practicable when collecting foreign intelligence that does not 
concern criminal activities or threats to the national security. 

3. Respect for Legal Rights 

All activities under these Guidelines must have a valid purpose consistent with 
these Guidelines, and must be carried out in conformity with the Constitution and 
all applicable statutes, executive orders, Department of Justice regulations and 
policies, and Attorney General guidelines. These Guidelines do not authorize 
investigating or collecting or maintaining information on United States persons 
solely for the purpose of monitoring activities protected by the First Amendment 
or the lawful exercise of other rights secured by the Constitution or laws of the 
United States. These Guidelines also do not authorize any conduct prohibited by 
the Guidance Regarding the Use of Race by Federal Law Enforcement Agencies. 

4. Undisclosed Participation in Organizations 

Undisclosed participation in organizations in activities under these Guidelines 
shall be conducted in accordance with FBI policy approved by the Attorney 
General. 

5. Maintenance of Records under the Privacy Act 

The Privacy Act restricts the maintenance of records relating to certain activities 
of individuals who are United States persons, with exceptions for circumstances 
in which the collection of such information is pertinent to and within the scope of 
an authorized law enforcement activity or is otherwise authorized by statute. 5 
U.S.C. 552a(e)(7). Activities authorized by these Guidelines are authorized law 
enforcement activities or activities for which there is otherwise statutory authority 
for purposes of the Privacy Act. These Guidelines, however, do not provide an 
exhaustive enumeration of authorized FBI law enforcement activities or FBI 
activities for which there is otherwise statutory authority, and no restriction is 
implied with respect to such activities carried out by the FBI pursuant to other 
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authorities. Further questions about the application of the Privacy Act to 
authorized activities of the FBI should be addressed to the FBI Office of the 
General Counsel, the FBI Privacy and Civil Liberties Unit, or the Department of 
• Justice Office of Privacy and Civil Liberties. 

NATURE AND APPLICATION OF THE GUIDELINES 

1. Repealers 

These Guidelines supersede the following guidelines, which are hereby repealed: 

a. The Attorney General’s Guidelines on General Crimes, Racketeering 
Enterprise and Terrorism Enterprise Investigations (May 30, 2002) and all 
predecessor guidelines thereto. 

b. The Attorney General’s Guidelines for FBI National Security 
Investigations and Foreign Intelligence Collection (October 31, 2003) and 
all predecessor guidelines thereto. 

c. The Attorney General’s Supplemental Guidelines for Collection, 
Retention, and Dissemination of Foreign Intelligence (November 29, 
2006). 

d. The Attorney General Procedure for Reporting and Use of Information 
Concerning Violations of Law and Authorization for Participation in 
Otherwise Illegal Activity in FBI Foreign Intelligence, Counterintelligence 
or International Terrorism Intelligence Investigations (August 8, 1988). 

e. The Attorney General’s Guidelines for Reporting on Civil Disorders and 
Demonstrations Involving a Federal Interest (April 5, 1976). 

2. Status as Internal Guidance 

These Guidelines are set forth solely for the purpose of internal Department of 
Justice guidance. They are not intended to, do not, and may not be relied upon to 
create any rights, substantive or procedural, enforceable by law by any party in 
any matter, civil or criminal, nor do they place any limitation on otherwise lawful 
investigative and litigative prerogatives of the Department of Justice. 

3. Departures from the Guidelines 

Departures from these . Guidelines must be approved by the Director of the FBI, by 
the Deputy Director of the FBI, or by an Executive Assistant Director designated 
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by the Director. If a departure is necessary without such prior approval because of 
the immediacy or gravity of a threat to the safety of persons or property or to the 
national security, the Director, the Deputy Director, or a designated Executive 
Assistant Director shall be notified as soon thereafter as practicable. The FBI 
shall provide timely written notice of departures from these Guidelines to the 
Criminal Division and the National Security Division, and those divisions shall 
notify the Attorney General and the Deputy Attorney General. Notwithstanding 
this paragraph, all activities in all circumstances must be carried out in a manner 
consistent with the Constitution and laws of the United States. 

Other Activities Not Limited 

These Guidelines apply to FBI activities as'provided herein and do not limit other 
authorized activities of the FBI, such as the FBI’s responsibilities to conduct 
background checks and inquiries concerning applicants and employees under 
federal personnel security programs, the FBI’s maintenance and operation of 
national criminal records systems and preparation of national crime statistics, and 
the forensic assistance and administration functions of the FBI Laboratory. 
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II. INVESTIGATIONS AND INTELLIGENCE GATHERING 


This Part of the Guidelines authorizes the FBI to conduct investigations to detect, obtain 
information about, and prevent and protect against federal crimes and threats to the national 
security and to collect foreign intelligence. 

When an authorized purpose exists, the focus of activities authorized by this Part may be 
whatever the circumstances warrant. The subject of such an activity may be, for example, a 
particular crime or threatened crime; conduct constituting a threat to the national security, an 
individual, group, or organization that may be involved in criminal or national security- 
threatening conduct; or a topical matter of foreign intelligence interest. 

Investigations may also be undertaken for protective purposes in relation to individuals, 
groups, or other entities that may be targeted for criminal victimization or acquisition, or for 
terrorist attack or other depredations by the enemies of the United States. For example, the 
participation of the FBI in special events management, in relation to public events or other 
activities whose character may make them attractive targets for terrorist attack, is an authorized 
exercise of the authorities conveyed by these Guidelines. Likewise, FBI counterintelligence 
activities directed to identifying and securing facilities, personnel, or information that maybe 
targeted for infiltration, recruitment, or acquisition by foreign intelligence services are authorized 
exercises of the authorities conveyed by these Guidelines. 

The identification and recruitment of human sources - who may be able to provide or 
obtain information relating to criminal activities, information relating to terrorism, espionage, or 
other threats to the national security, or information relating to matters of foreign intelligence 
interest - is also critical to the effectiveness of the FBI’s law enforcement, national security, and 
intelligence programs, and activities undertaken for this purpose are authorized and encouraged. 

The scope of authorized activities under this Part is not limited to “investigation” in a 
narrow sense, such as solving particular cases or obtaining evidence for use in particular criminal 
prosecutions. Rather, these activities also provide critical information needed for broader 
analytic and intelligence purposes to facilitate the solution and prevention of crime, protect the 
national security, and further foreign intelligence objectives. These purposes include use of the 
information in intelligence analysis and planning under Part IV, and dissemination of the 
information to other law enforcement, Intelligence Community, and White House agencies under 
Part VI. Information obtained at all stages of investigative activity is accordingly to be retained 
and disseminated for these purposes as provided in these Guidelines, or in FBI policy consistent 
with these Guidelines, regardless of whether it furthers investigative objectives in a narrower or 
more immediate sense. 

In the course of activities under these Guidelines, the FBI may incidentally obtain 
information relating to matters outside of its areas of primary investigative responsibility. For 
example, information relating to violations of state or local law or foreign law may be 
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incidentally obtained in the course of investigating federal crimes or threats to the national 
security or in collecting foreign intelligence. These Guidelines do not bar the acquisition of such 
information in the course of authorized investigative activities, the retention of such information, 
or its dissemination as appropriate to the responsible authorities in other agencies or 
jurisdictions. Part VI of these Guidelines includes specific authorizations and requirements for 
sharing such information with relevant agencies and officials. 

This Part authorizes different levels of information gathering activity, which afford the 
FBI flexibility, under appropriate standards and procedures, to adapt the methods utilized and the 
information sought to the nature of the matter under investigation and the character of the 
information supporting the need for investigation. 

Assessments, authorized by Subpart A of this Part, require an authorized purpose but not 
any particular factual predication. For example, to carry out its central mission of preventing the 
commission of terrorist acts against the United States and its people, the FBI must proactively 
draw on available sources of information to identify terrorist threats and activities. It cannot be 
content to wait for leads to come in through the actions of others, but rather must be vigilant in 
detecting terrorist activities to the full extent permitted by law, with an eye towards early 
intervention and prevention of acts of terrorism before they occur. Likewise, in the exercise of 
its protective functions, the FBI is not constrained to wait until information is received indicating 
that a particular event, activity, or facility has drawn file attention of those who would threaten 
fixe national security. Rather, the FBI must take the initiative to secure and protect activities and 
entities whose character may make them attractive targets for terrorism or espionage. The 
proactive investigative authority conveyed in assessments is designed for, and may be utilized by, 
the FBI in the discharge of these responsibilities. For example, assessments may be conducted as 
part of the FBI’s special events management activities. 

More broadly, detecting and interrupting criminal activities at their early stages, and 
preventing crimes from occurring in the first place, is preferable to allowing criminal plots and 
activities to come to fruition. Hence, assessments may be undertaken proactively with such 
objectives as detecting criminal activities; obtaining information on individuals, groups, or 
organizations of possible investigative interest, either because they may be involved in criminal 
or national security-threatening activities or because they may be targeted for attack or 
victimization by such activities; and identifying and assessing individuals who may have value as 
human sources. For example, assessment activities may involve proactively surfing the Internet 
to find publicly accessible websites and services through which recruitment by terrorist 
organizations and promotion of terrorist crimes is openly taking place; through which child 
pornography is advertised and traded; through which efforts are made by sexual predators to lure 
children for purposes of sexual abuse; or through which fraudulent schemes are perpetrated 
against the public. 

The methods authorized in assessments are generally those of relatively low 
intrusiveness, such as obtaining publicly available information, checking government records, 
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and requesting information from members of the public. These Guidelines do not impose 
supervisory approval requirements in assessments, given the types of techniques that are 
authorized at this stage (e.g., perusing the Internet for publicly available information). However, 
FBI policy will prescribe supervisory approval requirements for certain assessments, considering 
such matters as the purpose of the assessment and the methods being utilized. 

Beyond the proactive information gathering functions described above, assessments may 
be used when allegations or other information concerning crimes or threats to the national 
security is received or obtained, and the matter can be checked out or resolved through the 
relatively non-intrusive methods authorized in assessments. The checking of investigative leads 
in this manner can avoid the need to proceed to more formal levels of investigative activity, if the 
results of an assessment indicate that further investigation is not warranted. 

Subpart B of this Part authorizes a second level of investigative activity, predicated 
investigations. The purposes or objectives of predicated investigations are essentially the same 
as those of assessments, but predication as provided in these Guidelines is needed - generally, 
allegations, reports, facts or circumstances indicative of possible criminal or national security- 
threatening activity, or the potential for acquiring information responsive to foreign intelligence 
requirements - and supervisory approval must be obtained, to initiate predicated investigations. 
Corresponding to the stronger predication and approval requirements, all lawful methods may be 
used in predicated investigations. A classified directive provides further specification concerning 
circumstances supporting certain predicated investigations. 

Predicated investigations that concern federal crimes or threats to the national security are 
subdivided into preliminary investigations and full investigations. Preliminary investigations 
may be initiated on the basis of any allegation or information indicative of possible criminal or 
national security-threatening activity, but more substantial factual predication is required for full 
investigations. While time limits are set for the completion of preliminary investigations, full 
investigations may be pursued without preset limits on their duration. 

The final investigative category under this Part of the Guidelines is enterprise 
investigations, authorized by Subpart C, which permit a general examination of the structure, 
scope, and nature of certain groups and organizations. Enterprise investigations are a type of full 
investigations. Hence, they are subject to the purpose, approval, and predication requirements 
that apply to full investigations, and all lawful methods may be used in carrying them out. The 
distinctive characteristic of enterprise investigations is that they concern groups or organizations 
that may be involved in the most serious criminal or national security threats to the public — 
generally, patterns of racketeering activity, terrorism or other threats to the national security, or 
the commission of offenses characteristically involved in terrorism as described in 18 U.S.C. 
2332b(g)(5)(B). A broad examination of the characteristics of groups satisfying these criteria is 
authorized in enterprise investigations, including any relationship of the group to a foreign 
power, its size and composition, its geographic dimensions and finances, its past acts and goals, 
and its capacity for harm. 


■ 18 


A-19 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 


Verison Dated: 
October 15, 2011 


UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 


ASSESSMENTS 
1. Purposes 

Assessments may be carried out to detect, obtain information about, or prevent or 
protect against federal crimes or threats to the national security or to collect 
foreign intelligence. 

_ 2. Approval 

The conduct of assessments is subject to any supervisory approval requirements 
prescribed by FBI policy. 

3. Authorized Activities 

Activities that may be carried out for the purposes described in paragraph 1. in an 
assessment include: 

a. seeking information, proactively or in response to investigative leads, 
relating to: 

i. activities constituting violations of federal criminal law or threats 
to the national security, 

ii. the involvement or role of individuals, groups, or organizations in 
such activities; or 

iii. matters of foreign intelligence interest responsive to foreign 
intelligence requirements; 

b. identifying and obtaining information about potential targets of or 
vulnerabilities to criminal activities in violation of federal law or threats to 
the national security; 

c. seeking information to identify potential human sources, assess the 
suitability, credibility, or value of individuals as human sources, validate 
human sources, or maintain the cover or credibility of human sources, who 

■ may be able to provide or obtain information relating to criminal activities 
in violation of federal law, threats to the national security, or matters of 
foreign intelligence interest; and 

d. obtaining information to inform or facilitate intelligence analysis and 
planning as described in Part IV of these Guidelines. 
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4. Authorized Methods 

Only the following methods may be used in assessments: 

a. Obtain publicly available information. 

b. Access and examine FBI and other Department of Justice records, and 
obtain information from any FBI or other Department of Justice personnel. 

c. Access and examine records maintained by, and request information from, 
other federal, state, local, or tribal, or foreign governmental entities or 
agencies. 

d. Use online services and resources (whether nonprofit or commercial). 

e. Use and recruit human sources in conformity with the Attorney General’s 
Guidelines Regarding the Use of FBI Confidential Human Sources. 

f. Interview or request information from members of the public and private 
entities. 

g. Accept information voluntarily provided by governmental or private 
entities. 

h. Engage in observation or surveillance not requiring a court order. 

i. Grand jury subpoenas for telephone or electronic mail subscriber 
information. 

PREDICATED INVESTIGATIONS 

1. Purposes 

•Predicated investigations may be carried out to detect, obtain information about, 
or prevent or protect against federal crimes or threats to the national security or to 
collect foreign intelligence. 

2. Approval 

The initiation of a predicated investigation requires supervisory approval at a level 
or levels specified by FBI policy. A predicated investigation based on paragraph 

3.c. (relating to foreign intelligence) must be approved by a Special Agent in • 
Charge or by an FBI Headquarters official as provided in such policy. 
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Circumstances Warranting Investigation 

A predicated investigation may be initiated on the basis of any of the following 
circumstances: 

a. An activity constituting a federal crime or a threat to the national security 
has or may have occurred, is or may be occurring, or will or may occur and 
the investigation may obtain information relating to the activity or the 
involvement or role of an individual, group, or organization in such 
activity. 

b. An individual, group, organization, entity, information, property, or 
activity is or may be a target of attack, victimization, acquisition, 
infiltration, or recruitment in connection with criminal activity in violation 
of federal law or a threat to the national security and the investigation may 
obtain information that would help to protect against such activity or 
threat. 

c. The investigation may obtain foreign intelligence that is responsive to a 
. foreign intelligence requirement. 

Preliminary and Full Investigations 

A predicated investigation relating to a federal crime or threat to the national 
security may be conducted as a preliminary investigation or a full investigation. A 
predicated investigation that is based solely on the authority to collect foreign 
intelligence may be conducted only as a full investigation. 

a. Preliminary investigations 

i. Predication Required for Preliminary Investigations 

A preliminary investigation may be initiated on the basis of 
information or an allegation indicating the existence of a 
circumstance described in paragraph 3.a.-.b. 

ii. Duration of Preliminary Investigations 

A preliminary investigation must be concluded within six months 
of its initiation, which may be extended by up to six months by the 
Special Agent in Charge. Extensions of preliminary investigations 
beyond a year must be approved by FBI Headquarters. 
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iii. Methods Allowed in Preliminary Investigations 

All lawful methods, may be used in a preliminary investigation 
except for methods within the scope of Part V.A.1 1.-.13. of these 
Guidelines. 

b. Full Investigations 

i. Predication Required for Full Investigations 

A full investigation may be initiated if there is an articulable 
factual basis for the investigation that reasonably indicates that a 
circumstance described in paragraph 3.a.-.b. exists or if a 
circumstance described in paragraph 3.c. exists. 

ii. Methods Allowed in Full Investigations 

All lawful methods may be used in a full investigation. 

Notice Requirements 

a. An FBI field office shall notify FBI Headquarters and the United States 
Attorney or other appropriate Department of Justice official of the 
initiation by the field office of a predicated investigation involving a 
sensitive investigative matter. If the investigation is initiated by FBI 
Headquarters, FBI Headquarters shall notify the United States Attorney or 
other appropriate Department of Justice official of the initiation of such an 
investigation. If the investigation concerns a threat to the national 
security, an official of the National Security Division must be notified. 

The notice shall identify all sensitive investigative matters involved in the 
investigation. 

b. The FBI shall notify the National Security Division of: 

i. the initiation of any full investigation of a United States person 
relating to a threat to the national security; and 

ii. the initiation of any full investigation that is based on paragraph 
3.c. (relating to foreign intelligence). 

c. The notifications under subparagraphs a. and b. shall be made as soon as 
practicable, but no later than 30 days after the initiation of an 
investigation. 
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d. The FBI shall notify the Deputy Attorney General if FBI Headquarters 

disapproves a field office’s initiation of a predicated investigation relating 
to a threat to the national security on the ground that the predication for the 
investigation is insufficient. 

ENTERPRISE INVESTIGATIONS 

1. Definition 

A full investigation of a group or organization may be initiated as an enterprise 
investigation if there is an articulable factual basis for the investigation that 
reasonably indicates that the group or organization may have engaged or may be 
engaged in, or may have or may be engaged in planning or preparation or 
provision of support for: 

a. a pattern of racketeering activity as defined in 1 8 U.S .C. 1 96 1 (5); 

b. international terrorism or other threat to the national security; 

c. domestic terrorism as defined in 1 8 U.S.C. 233 1 (5) involving a violation 
of federal criminal law; 

d. furthering political or social goals wholly or in part through activities that 
involve force or violence and a violation of federal criminal law; or 

e. an offense described in 1 8 U.S.C. 2332b(g)(5)(B) or 18 U.S.C. 43. 

2. Scope 

The information sought in an enterprise investigation may include a general 
examination of the structure, scope, and nature of the group or organization 
including: its relationship, if any, to a foreign power; the identity and relationship 
of its members, employees, or other persons who maybe acting in furtherance of 
its objectives; its finances and resources; its geographical dimensions; and its past 
and future activities and goals. 

3. Notice and Reporting Requirements 

a. The responsible Department of Justice component for the purpose of 

notification and reports in enterprise investigations is the National Security 
Division, except that, for the purpose of notifications and reports in an 
enterprise investigation relating to a pattern of racketeering activity that 
does not involve an offense or offenses described in 18 U.S.C. 
2332b(g)(5)(B), the responsible Department of Justice component is the 
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Organized Crime and Racketeering Section of the Criminal Division. 

b. An FBI field office shall notify FBI Headquarters of the initiation by the 
field office of an enterprise investigation. 

c. The FBI shall notify the National Security Division or the Organized 
Crime and Racketeering Section of the initiation of an enterprise 
investigation, whether by a field office or by FBI Headquarters, and the 
component so notified shall notify the Attorney General and the Deputy 
Attorney General. The FBI shall also notify any relevant United States 
Attorney’s Office, except that any investigation within the scope of Part 
VLD.l.d of these Guidelines (relating to counterintelligence 
investigations) is to be treated as provided in that provision. Notifications 
by the FBI under this subparagraph shall be provided as soon as 
practicable, but no later than 30 days after the initiation of the 
investigation. 

d. The Assistant Attorney General for National Security or the Chief of the 
Organized Crime and Racketeering Section, as appropriate, may at any 
time request the FBI to provide a report on the status of an enterprise 
investigation and the FBI will provide such reports as requested. 
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III. ASSISTANCE TO OTHER AGENCIES 

The FBI is authorized to provide investigative assistance to other federal, state, local, or 
tribal, or foreign agencies as provided in this Part. 

The investigative assistance authorized by this Part is often concerned with the same 
objectives as those identified in Part II of these Guidelines - investigating federal crimes and 
threats to the national security, and collecting foreign intelligence, hr some cases, however, 
investigative assistance to other agencies is legally authorized for purposes other than those 
identified in Part n, such as assistance in certain contexts to state or local agencies in the 
investigation of crimes under state or local law, see 28 U.S.C. 540, 540A, 540B, and assistance 
to foreign agencies in the investigation of foreign law violations pursuant to international 
agreements. Investigative assistance for such legally authorized purposes is permitted under this 
Part, even if it is not for purposes identified as grounds for investigation under Part n. 

The authorities provided by this Part are cumulative to Part II and do not limit the EBI’s 
investigative activities under Part H For example, Subpart B.2 in this Part authorizes 
investigative activities by the FBI in certain circumstances to inform decisions by the President 
concerning the deployment of troops to deal with civil disorders, and Subpart B.3 authorizes 
investigative activities to facilitate demonstrations and related public health and safety measures. 
The requirements and limitations in these provisions for conducting investigations for the 
specified purposes do not limit the FBI’s authority under Part II to investigate federal crimes or 
threats to the national security that occur in the context of or in connection with civil disorders or 
demonstrations. 

A. THE INTELLIGENCE COMMUNITY 

The FBI may provide investigative assistance (including operational support) to 

authorized intelligence activities of other Intelligence Community agencies. 

B. FEDERAL AGENCIES GENERALLY 

1. In General 

The FBI may provide assistance to any federal agency in the investigation of 
federal crimes or threats to the national security or in the collection of foreign 
intelligence, and investigative assistance to any federal agency for any other 
purpose that may be legally authorized, including investigative assistance to the 
Secret Service in support of its protective responsibilities. 

2. The President in Relation to Civil Disorders 

a. At the direction of the Attorney General, the Deputy Attorney General, or 
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the Assistant Attorney General for the Criminal Division, the FBI shall 
collect information relating to actual or threatened civil disorders to assist 
the President in determining (pursuant to the authority of the President 
under 10 U.S.C. 331-33) whether use of the armed forces or militia is 
required and how a decision to commit troops should be implemented. 

The information sought shall concern such matters as: 

i. The size of the actual or threatened disorder, both in number of 
people involved or affected and in geographic area. 

ii. The potential for violence. 

iii. The potential for expansion of the disorder in light of community 
conditions and underlying causes of the disorder. 

iv. The relationship of the actual or threatened disorder to the 
enforcement of federal law or court orders and the likelihood that 
state or local authorities will assist in enforcing those laws or 
orders. 

v. The extent of state or local resources available to handle the 
disorder. 

b. Investigations under this paragraph will be authorized only for a period of 
30 days, but the authorization may be renewed for subsequent 30 day 
periods. 

c. Notwithstanding Subpart E.2 of this Part, the methods that may be used in 
an investigation under this paragraph are those described in subparagraphs 
a.-.d., subparagraph f. (other than pretext interviews or requests), or 
subparagraph g. of Part HA.4 of these Guidelines. The Attorney General, 

• the Deputy Attorney General, or the Assistant Attorney General for the 
Criminal Division may also authorize the use of other methods described 
in Part H.A.4. 

Public Health and Safety Authorities in Relation to Demonstrations 

a. At the direction of the Attorney General, the Deputy Attorney General, or 

the Assistant Attorney General for the Criminal Division, the FBI shall 
collect information relating to demonstration activities that are likely to 
require the federal government to take action to facilitate the activities and 
provide public health and safety measures with respect to those activities. 
The information sought in such an investigation shall be that needed to 
facilitate an adequate federal response to ensure public health and safety 
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and to protect the exercise of First Amendment rights, such as: 

i. The time, place, and type of activities planned. 

ii. The number of persons expected to participate. 

iii. The expected means and routes of travel for participants and 
expected time of arrival. 

iv. Any plans for lodging or housing of participants in connection with 
the demonstration. 

b. Notwithstanding Subpart E.2 of this Part, the methods that may be used in 
an investigation under this paragraph are those described in subparagraphs 
a.-.d., subparagraph f. (other than pretext interviews or requests), or 
subparagraph g. of Part n.A.4 of these Guidelines. The Attorney General, 
the Deputy Attorney General, or the Assistant Attorney General for the 
Criminal Division may also authorize the use of other methods described 
in Part E.A.4. 

C. STATE, LOCAL, OR TRIBAL AGENCIES 

The FBI may provide investigative assistance to state, local, or tribal agencies in the 
investigation of matters that may involve federal crimes or threats to the national security, 
or for such other purposes as may be legally authorized. 

D. FOREIGN AGENCIES 

1 . At the request of foreign law enforcement, intelligence, or security agencies, the 
FBI may conduct investigations or provide assistance to investigations by such 
agencies, consistent with the interests of the United States (including national 
security interests) and with due consideration of the effect on any United States 
person. Investigations or assistance under this paragraph must be approved as 
provided by FBI policy. The FBI shall notify the National Security Division 
concerning investigation or assistance under this paragraph where: (i) FBI 
Headquarters approval for the activity is required pursuant to the approval policy 
adopted by the FBI for purposes of this paragraph, and (ii) the activity relates to a 
threat to the national security. Notification to the National Security Division shall 
be made as soon as practicable but no later than 30 days after the approval. 
Provisions regarding notification to or coordination with the Central Intelligence 
Agency by the FBI in memoranda of understanding or agreements with the 
Central Intelligence Agency may also apply to activities under this paragraph. 

2. The FBI may not provide assistance to foreign law enforcement, intelligence, or 
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security officers conducting investigations within the United States unless such 
officers have provided prior notification to the Attorney General as required by 18 
U.S.C. 951. 

3 . The FBI may conduct background inquiries concerning consenting individuals 
when requested by foreign government agencies. 

4. The FBI may provide other material and technical assistance to foreign 
governments to the extent not otherwise prohibited by law. 

APPLICABLE STANDARDS AND PROCEDURES 

1 . Authorized investigative assistance by the FBI to other agencies under this Part 
includes joint operations and activities with such agencies. 

2. All lawful methods may be used in investigative assistance activities under this 
Part. 

3. Where the methods used in investigative assistance activities under this Part go 
beyond the methods authorized in assessments under Part n.A.4 of these 
Guidelines, the following apply: 

a. Supervisory approval must be obtained for the activity at a level or levels 
specified in FBI policy. 

b. Notice must be provided concerning sensitive investigative matters in the 
manner described in Part E.B.5. 

c. A database or records system must be maintained that permits, with 
respect to each such activity, the prompt retrieval of the status of the 
activity (open or closed), the dates of opening and closing, and the basis 
for the activity. This database or records system may be combined with 
the database or records system for predicated investigations required by 
Part VI.A.2. 
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IV. INTELLIGENCE ANALYSIS AND PLANNING 

The FBI is authorized to engage in analysis and planning. The FBI’s analytic activities 
enable the FBI to identify and understand trends, causes, and potential indicia of criminal activity 
and other threats to the United States that would not be apparent from the investigation of 
discrete matters alone. By means of intelligence analysis and strategic planning, the FBI can 
more effectively discover crimes, threats to the national security, and other matters of national 
intelligence interest and can provide the critical support needed for the effective discharge of its 
investigative responsibilities and other authorized activities. For example, analysis of threats in 
the context of special events management, concerning public events or activities that maybe 
targeted for terrorist attack, is an authorized activity under this Part. 

In carrying out its intelligence functions under this Part, the FBI is authorized to draw on 
all lawful sources of information, including but not limited to the results of investigative 
activities under these Guidelines. Investigative activities under these Guidelines and other 
legally authorized activities through which the FBI acquires information, data, or intelligence 
may properly be utilized, structured, and prioritized so as to support and effectuate the FBI’s 
intelligence mission. The remainder of this Part provides further specification concerning 
activities and functions authorized as part of that mission. 

A. STRATEGIC INTELLIGENCE ANALYSIS 

The FBI is authorized to develop overviews and analyses of threats to and vulnerabilities 
of the United States and its interests in areas related to the FBI’s responsibilities, 
including domestic and international criminal threats and activities; domestic and 
international activities, circumstances, and developments affecting the national security; 
and matters relevant to the conduct of the United States’ foreign affairs. The overviews 
and analyses prepared under this Subpart may encompass present, emergent, and potential 
threats and vulnerabilities, their contexts and causes, and identification and analysis of 
means of responding to them. 

B. REPORTS AND ASSESSMENTS GENERALLY 

The FBI is authorized to conduct research, analyze information, and prepare reports and 
assessments concerning matters relevant to authorized FBI activities, such as reports and 
assessments concerning: types of criminals or criminal activities; organized crime groups; 
terrorism, espionage, or other threats to the national security; foreign intelligence matters; 
or the scope and nature of criminal activity in particular geographic areas or sectors of the 
economy. 

C. INTELLIGENCE SYSTEMS 

The FBI is authorized to operate intelligence, identification, tracking, and information 
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systems in support of authorized investigative activities, or for such other or additional 
purposes as may be legally authorized, such as intelligence and tracking systems relating 
to terrorists, gangs, or organized crime groups. 
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V. AUTHORIZED METHODS 

A. PARTICULAR METHODS 

All lawful investigative methods may be used in activities under these Guidelines as 
authorized by these Guidelines. Authorized methods include, but are not limited to, those 
identified in the following list. The methods identified in the list are in some instances subject to 
special restrictions or review or approval requirements as noted: 

1 . The methods described in Part II. A.4 of these Guidelines. 

2. Mail covers. 

3 . Physical searches of personal or real property where a warrant or court order is not 
legally required because there is no reasonable expectation of privacy (e.g., trash 
covers). 

4. Consensual monitoring of communications, including consensual computer 
monitoring, subject to legal review by the Chief Division Counsel or the FBI 
Office of the General Counsel. Where a sensitive monitoring circumstance is 
involved, the monitoring must be approved by the Criminal Division or, if the 
investigation concerns a threat to the national security or foreign intelligence, by 
the National Security Division. 

5. Use of closed-circuit television, direction finders, and other monitoring devices, 
subject to legal review by the Chief Division Counsel or the FBI Office of the 
General Counsel. (The methods described in this paragraph usually do not require 
court orders or warrants unless they involve physical trespass or non-consensual 
monitoring of communications, but legal review is necessary to ensure 
compliance with all applicable legal requirements.) 

.6. Polygraph examinations. 

7. Undercover operations. In investigations relating to activities in violation of 
federal criminal law that do not concern threats to the national security or foreign 
intelligence, undercover operations must be carried out in conformity with the 
Attorney General’s Guidelines on Federal Bureau of Investigation Undercover 
Operations. In investigations that are not subject to the preceding sentence 
because they concern threats to the national security or foreign intelligence, 
undercover operations involving religious or political organizations must be 
reviewed and approved by FBI Headquarters, with participation by the National 
Security Division in the review process. 

8. Compulsory process as authorized by law, including grand jury subpoenas and 
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other subpoenas, National Security Letters (15 U.S.C. 1681u, 1681 v; 18 U.S.C. 
2709; 12 U.S.C. 3414(a)(5)(A); 50 U.S.C. 436), and Foreign Intelligence 
Surveillance Act orders for the production of tangible things (50 U.S.C. 1861-63). 

9. Accessing stored wire and electronic communications and transactional records in 
conformity with chapter 121 of title 18, United States Code (18 U.S.C. 2701- 
2712)'. 

10. Use of pen registers and trap and trace devices in conformity with chapter 206 of 
title 18, United States Code (18 U.S.C. 3121-3127), or the Foreign Intelligence 
Surveillance Act (50 U.S.C. 1841-1846). 

1 1 . Electronic surveillance in conformity with chapter 1 1 9 of title 1 8, United States 
Code (18 U.S.C. 2510-2522), the Foreign Intelligence Surveillance Act, or 

■ Executive Order 12333 § 2.5. 

1 2. Physical searches, including mail openings, in conformity with Rule 4 1 of the 
Federal Rules of Criminal Procedure, the Foreign Intelligence Surveillance Act, or 
Executive Order- 12333 § 2.5. A classified directive provides additional limitation 
on certain searches. 

1 3 . Acquisition of foreign intelligence information in conformity with title VH of the 
Foreign Intelligence Surveillance Act. 

SPECIAL REQUIREMENTS 

Beyond the limitations noted in the’ list above relating to particular investigative methods, 

the following requirements are to be observed: 

1. Contacts with Represented Persons 

Contact with represented persons may implicate legal restrictions and affect the 
admissibility of resulting evidence. Hence, if an individual is known to be 
represented by counsel in a particular matter, the FBI will follow applicable law 
and Department procedure concerning contact with represented individuals in the 
absence of prior notice to counsel. The Special Agent in Charge and the United 
States Attorney or their designees shall consult periodically on applicable law and 
Department procedure. Where issues arise concerning the consistency of contacts 
with represented persons with applicable attorney conduct rules, the United States 
Attorney’s Office should consult with the Professional Responsibility Advisory 
Office. 
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2. Use of Classified Investigative Technologies 

Inappropriate use of classified investigative technologies may risk the 
compromise of such technologies. Hence, in an investigation relating to activities 
in violation of federal criminal law that does not concern a threat to the national 
security or foreign intelligence, the use of such technologies must be in 
conformity with the Procedures for the Use of Classified Investigative 
Technologies in Criminal Cases. 

OTHERWISE ILLEGAL ACTIVITY 

1 . Otherwise illegal activity by an FBI agent or employee in an undercover operation 
relating to activity in violation of federal criminal law that does not concern a 
threat to the national security or foreign intelligence must be approved in 
conformity with the Attorney General’s Guidelines on Federal Bureau of 
Investigation Undercover Operations. Approval of otherwise illegal activity in 
conformity with those guidelines is sufficient and satisfies any approval 
requirement that would otherwise apply under these Guidelines. 

2. Otherwise illegal activity by a human source must be approved in conformity with 
the Attorney General’s Guidelines Regarding the Use of FBI Confidential Human 
Sources. 

3 . Otherwise illegal activity by an FBI agent or employee that is not within the scope 
of paragraph 1. must be approved by a United States Attorney’s Office or a 
Department of Justice Division, except that a Special Agent in Charge may 
authorize the following: 

a. otherwise illegal activity that would not be a felony under federal, state, 
local, or tribal law; 

b. consensual monitoring of communications, even if a crime under state, 
local, or tribal law; 

c. the controlled purchase, receipt, delivery, or sale of drugs, stolen property, 
or other contraband; 

d. the payment of bribes; 

e. the making of false representations in concealment of personal identity or 
the true ownership of a proprietary; and 

f. conducting a money laundering transaction or transactions involving an 
aggregate amount not exceeding $1 million. 
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However, in an investigation relating to a threat to the national security or foreign 
intelligence collection, a Special Agent in Charge may not authorize an activity 
that may constitute a violation of export control laws or laws that concern the 
proliferation of weapons of mass destruction. In such an investigation, a Special 
Agent in Charge may authorize an activity that may otherwise violate prohibitions 
of materia] support to terrorism only in accordance with standards established by 
the Director of the FBI and agreed to by the Assistant Attorney General for 
National Security. 

4. The following activities may not be authorized: 

a. Acts of violence. 

b. Activities whose authorization is prohibited by law, including unlawful 
investigative methods, such as illegal electronic surveillance or illegal 
searches. 

Subparagraph a., however, does not limit the right of FBI agents or employees to 
engage in any lawful use of force, including the use of force in self-defense or 
defense of others or otherwise in the lawful discharge of their duties. 

5. An agent or employee may engage in otherwise illegal activity that could be 
authorized under this Subpart without the authorization required by paragraph 3. if 
necessary to meet an immediate threat to the safety of persons or property or to the 

, national security, or to prevent the compromise of an investigation or the loss of a 
significant investigative opportunity. In such a case, prior to engaging in the 
otherwise illegal activity, every effort should be made by the agent or employee to 
consult with the Special Agent in Charge, and by the Special Agent in Charge to 
consult with the United States Attorney’s Office or appropriate Department of 
Justice Division where the authorization of that office or division would be 
required under paragraph 3., unless the circumstances preclude such consultation. 
Cases in which otherwise illegal activity occurs pursuant to this paragraph without 
the authorization required by paragraph 3. shall be reported as soon as possible to 
the Special Agent in Charge, and by the Special Agent in Charge to FBI 
Headquarters and to the United States Attorney’s Office or appropriate 
Department of Justice Division. 

6. In an investigation relating to a threat to the national security or foreign 
intelligence collection, the National Security Division is the approving component 
for otherwise illegal activity for which paragraph 3. requires approval beyond 
internal FBI approval. However, officials in other components may approve 
otherwise illegal activity in such investigations as authorized by the Assistant 
Attorney General for National Security. 
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VI. RETENTION AND SHARING OF INFORMATION 

A. RETENTION OF INFORMATION 

1 . The FBI shall retain records relating to activities under these Guidelines in 
accordance with a records retention plan approved by the National Archives and 
Records Administration. 

2. The FBI shall maintain a database or records system that permits, with respect to 
each predicated investigation, the prompt retrieval of the status of the 
investigation (open or closed), the dates of opening and closing, and the basis for 
the investigation. 

B. INFORMATION SHARING GENERALLY 

1. Permissive Sharing 

Consistent with law and with any applicable agreements or understandings with 
other agencies concerning the dissemination of information they have provided, 
the FBI may disseminate information obtained or produced through activities 
under these Guidelines: 

a. within the FBI and to other components of the Department of Justice; 

b. to other federal, state, local, or tribal agencies if related to their 
responsibilities and, in relation to other Intelligence Community agencies, 
the determination whether the information is related to the recipient’s 
responsibilities may be left to the recipient; 

c. to congressional committees as authorized by the Department of Justice 
Office of Legislative Affairs; 

d. to foreign agencies if the information is related to their responsibilities and 
the dissemination is consistent with the interests of the United States 
(including national security interests) and the FBI has considered the effect 
such dissemination may reasonably be expected to have on any identifiable 
United States person; 

e. if the information is publicly available, does not identify United States 
persons, or is disseminated with the consent of the person whom it 
concerns; 

f. if the dissemination is necessary to protect the safety or security of persons 
or property, to protect against or prevent a crime or threat to the national 
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security, or to obtain information for the conduct of an authorized FBI 
investigation; or 

g. if dissemination of the information is otherwise permitted by the Privacy 
.Act (5 U.S.C. 552a). 

2. Required Sharing 

The FBI shall share and disseminate information as required by statutes, treaties, 
Executive Orders, Presidential, directives, National Security Council directives, 
Homeland Security Council directives, and Attorney General-approved policies, 
memoranda of understanding, or agreements. 

INFORMATION RELATING TO CRIMINAL MATTERS 

1. Coordination with Prosecutors 

In an investigation relating to possible criminal activity in violation of federal law, 
the agent conducting the investigation shall maintain periodic written or oral 
contact with the appropriate federal prosecutor, as circumstances warrant and as 
requested by the prosecutor. When, during such an investigation, a matter appears 
arguably to warrant prosecution, the agent shall present the relevant facts to the 
appropriate federal prosecutor. Information on investigations that have been 
closed shall be available on request to a United States Attorney or his or her 
designee or an appropriate Department of Justice official. 

2. Criminal Matters Outside FBI Jurisdiction 

When credible information is received by an FBI field office concerning serious 
criminal activity not within the FBI’s investigative jurisdiction, the field office 
shall promptly transmit the information or refer the complainant to a law 
enforcement agency having jurisdiction, except where disclosure would 
jeopardize an ongoing investigation, endanger the safety of an individual, disclose 
the identity of a human source, interfere with a human source’s cooperation, or 
reveal legally privileged information. If full disclosure is not made for the reasons 
indicated, then, whenever feasible, the FBI field office shall make at least limited 
disclosure to a law enforcement agency or agencies having jurisdiction, and full 
disclosure shall be made as soon as the need for restricting disclosure is no longer 
present. Where full disclosure is not made to the appropriate law enforcement 
agencies within ISO days, the FBI field office shall promptly notify FBI 
Headquarters in writing of the facts and circumstances concerning the criminal 
activity. The FBI shall make periodic reports to the Deputy Attorney General on 
such nondisclosures and incomplete disclosures, in a form suitable to protect the 
identity of human sources. 
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3. Reporting of Criminal Activity 

a. When it appears that an FBI agent or employee has engaged in criminal 
activity in the course of an investigation under these Guidelines, the FBI 
shall notify the United States Attorney’s Office or an appropriate 
Department of Justice Division. When it appears that a human source has 
engaged in criminal activity in the course of an investigation trader these 
Guidelines, the FBI shall proceed as provided in the Attorney General’s 
Guidelines Regarding the Use of FBI Confidential Human Sources. When 
information concerning possible criminal activity by any other person 
appears in the course of an investigation under these Guidelines, the FBI 
shall initiate an investigation of the criminal activity if warranted, and 
shall proceed as provided in paragraph 1 . or 2. 

b. The reporting requirements under this paragraph relating to criminal 
activity by FBI agents or employees or human sources do not apply, to 
otherwise illegal activity that is authorized in conformity with these 
Guidelines or other Attorney General guidelines or to minor traffic 
offenses. 

INFORMATION RELATING TO NATIONAL SECURITY AND FOREIGN 
INTELLIGENCE MATTERS 

The general principle reflected in current laws and policies is that there is a responsibility 
to provide information as consistently and fully as possible to agencies with relevant 
responsibilities to protect the United States and its people from terrorism and other threats 
to the national security, except as limited by specific constraints on such sharing. The 
FBI’s responsibilities in this area include carrying out the requirements of the 
Memorandum of Understanding Between the Intelligence Community, Federal Law 
Enforcement Agencies, and the Department of Homeland Security Concerning 
Information Sharing (March 4, 2003), or any successor memorandum of understanding or 
agreement. Specific requirements also exist for internal coordination and consultation 
with other Department of Justice components, and for provision of national security and 
foreign intelligence information to White House agencies, as provided in the ensuing 
paragraphs. 

1 . Department of Justice 

a. The National Security Division shall have access to all information 

obtained by the FBI through activities relating to threats to the national 
security or foreign intelligence. The Director of the FBI and the Assistant 
Attorney General for National Security shall consult concerning these 
activities whenever requested by either of them, and the FBI shall provide 
such reports and information concerning these activities as the Assistant 
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Attorney General for National Security may request. In addition to any 
reports or information the Assistant Attorney General for National 
Security may specially request under this subparagraph, the FBI shall 
provide annual reports to the National Security Division concerning its 
foreign intelligence collection program, including information concerning 
the scope and nature of foreign intelligence collection activities in each 
FBI field office. 

b. The FBI shall keep the National Security Division apprised of all 
information obtained through activities under these Guidelines that is 
necessary to the ability of the United States to investigate or protect 
against threats to the national security, which shall include regular 
consultations between the FBI and the National Security Division to 
exchange advice and information relevant to addressing such threats 
through criminal prosecution or other means. 

c. Subject to subparagraphs d. and e., relevant United States Attorneys’ 
Offices shall have access to and shall receive information from the FBI 
relating to threats to the national security, and may engage in consultations 
with the FBI relating to such threats, to the same extent as the National 
Security Division. The relevant United States Attorneys’ Offices shall 
receive such access and information from the FBI field offices. 

d. In a counterintelligence investigation - i.e., an investigation relating to a 
matter described in Part VH.S.2 of these Guidelines - the FBI’s provision 
of information to and consultation with a United States Attorney’s Office 
are subject to authorization by the National Security Division. In 
consultation with the Executive Office for United States Attorneys and the 
FBI, the National Security Division shall establish policies setting forth 
circumstances in which the FBI will consult with the National Security 
Division prior to informing relevant United States Attorneys’ Offices 
about such an investigation. The policies established by the National 
Security Division under this subparagraph shall (among other things) 
provide that: 

i. the National Security Division will, within 30 days, authorize the 
FBI to share with the United States Attorneys’ Offices information 
relating to certain espionage investigations, as defined by the 
policies, unless such information is withheld because of substantial 
national security considerations; and 

ii. the FBI may consult freely with United States Attorneys’ Offices 
concerning investigations within the scope of this subparagraph 
during an emergency, so long as the National Security Division is 
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notified of such consultation as soon as practical after the 
consultation. 

e. Information shared with a United States Attorney’s Office pursuant to 
subparagraph c. or d. shall be disclosed only to the United States Attorney 
or any Assistant United States Attorneys designated by the United States 
Attorney as points of contact to receive such information. The United 
States Attorneys and designated Assistant United States Attorneys shall 
have appropriate security clearances and shall receive training.in the 
handling of classified information and information derived from the 
Foreign Intelligence Surveillance Act, including training concerning the 
secure handling and storage of such information and training concerning 
requirements and limitations relating to the use, retention, and 
dissemination of such information. 

f. The disclosure and sharing of information by the FBI under this paragraph 
is subject to any limitations required in orders issued by the Foreign 
Intelligence Surveillance Court, controls imposed by the originators of 
sensitive material, and restrictions established by the Attorney General or 
the Deputy Attorney General in particular cases. The disclosure and 
sharing of information by the FBI under this paragraph that may disclose 
the identity of human sources is governed by the relevant provisions of the 
Attorney General’s Guidelines Regarding the Use of FBI Confidential 
Human Sources. 

White House 

In order to carry out their responsibilities, the President, the Vice President, the 
Assistant to the President for National Security Affairs, the Assistant to the 
President for Homeland Security Affairs, the National Security Council and its 
staff, the Homeland Security Council and its staff, and other White House 
officials and offices require information from all federal agencies, including 
foreign intelligence, and information relating to international terrorism and other 
threats to the national security. The FBI accordingly may disseminate to the 
White House foreign intelligence and national security information obtained 
through activities under these Guidelines, subject to the following standards and 
procedures: 

a. Requests to the FBI for such information from the White House shall be 
made through the National Security Council staff or Homeland Security 
Council staff including, but not iimited to, the National Security Council 
Legal and Intelligence Directorates and Office of Combating Terrorism, 
or through the President’s Intelligence Advisory Board or the Counsel to 
the President. 
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b. Compromising information concerning domestic officials or political 
organizations, or information concerning activities of United States 
persons intended to affect the political process in the United States, may 
be disseminated to the White House only with the approval of the Attorney 
General, based on a determination that such dissemination is needed for 
foreign intelligence purposes, for the purpose of protecting against 
international terrorism or other threats to the national security, or for the 
conduct of foreign affairs. However, such approval is not required for 
dissemination to the White House of information concerning efforts of 
foreign intelligence services to penetrate the White House, or concerning 
contacts by White House personnel with foreign intelligence service 
personnel. 

c. Examples of types of information that are suitable for dissemination to the 
White House on a routine basis include, but are not limited to: 

i. information concerning international terrorism; 

ii. information concerning activities of foreign intelligence services in 
the United States; 

iii. information indicative of imminent hostilities involving any 
foreign power; 

iv. information concerning potential cyber threats to the United States 
or its allies; 

v. information indicative of policy positions adopted by foreign 
officials, governments, or powers, or their reactions to United 
States foreign policy initiatives; 

vi. information relating to possible changes in leadership positions of 
foreign governments, parties, factions, or powers; 

vii. information concerning foreign economic or foreign political 
matters that might have national security ramifications; and 

viii. information set forth in regularly published national intelligence 
requirements. 

d. Communications by the FBI to the White House that relate to a national 
security matter and concern a litigation issue for a specific pending case 
must be made known to the Office of the Attorney General, the Office of 
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the Deputy Attorney General, or the Office of the Associate Attorney 
General. White House policy may specially limit or prescribe the White 
House personnel who may request information concerning such issues 
from the FBI. 

e. The limitations on dissemination of information by the FBI to the White 
House under these Guidelines do not apply to dissemination to the White 
House of information acquired in the course of an FBI investigation 
requested by the White House into the background of a potential employee 
or appointee, or responses to requests from the White House under 
Executive Order 10450. 

Special Statutory Requirements 

a. Dissemination of information acquired under the Foreign Intelligence 
Surveillance Act is, to the extent provided in that Act, subject to 
minimization procedures and other requirements specified in that Act. 

b. Information obtained through the use of National Security Letters under 1 5 
U.S.C. 1681v may be disseminated in conformity with the general 
standards of this Part. Information obtained through the use of National 
Security Letters under other statutes may be disseminated in conformity 
with the general standards of this Part, subject to any applicable limitations 
in their governing statutory provisions: 12 U.S.C. 3414(a)(5)(B); 15 
U.S.C. 1681u(f); 18 U.S.C. 2709(d); 50 U.S.C. 436(e). 


41 


A-42 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 


Verison Dated: 
October 15, 2011 


UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 


VII. DEFINITIONS 

A. CONSENSUAL MONITORING: monitoring of communications for which a court order 
or warrant is not legally required because of the consent of a party to the communication. 

B. EMPLOYEE: an FBI employee or an employee of another agency working under the 
direction and control of the FBI. 

C. FOR OR ON BEHALF OF A FOREIGN POWER: the determination that activities are 
for or on behalf of a foreign power shall be based on consideration of the extent to which 
the foreign power is involved in: 

1 . control or policy direction; 

2. financial or material support; or 

3. leadership, assignments, or discipline. 

D. FOREIGN COMPUTER INTRUSION: the use or attempted use of any cyber-activity or 
other means, by, for, or on behalf of a foreign power to scan, probe, or gain unauthorized 
access into one or more U.S.-based computers. 

E. FOREIGN INTELLIGENCE: information relating to the capabilities, intentions, or 

■ activities of foreign governments or elements thereof, foreign organizations or foreign 
persons, or international terrorists. 

F. FOREIGN INTELLIGENCE REQUIREMENTS: 

1 . national intelligence requirements issued pursuant to authorization by the Director 
of National Intelligence, including the National Intelligence Priorities Framework 
and the National HUMINT Collection Directives, or any successor directives 
thereto; 

2. requests to collect foreign intelligence by the President or by Intelligence 
Community officials designated by the President; and 

3. directions to collect foreign intelligence by the Attorney General, the Deputy 
Attorney General, or an official designated by the Attorney General. 

G. FOREIGN POWER: 

1 . a foreign government or any component thereof, whether or not recognized by the 
United States; 
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2. a faction of a foreign nation or nations, not substantially composed of United 
States persons; 

3. an entity that is openly acknowledged by a foreign government or governments to 
be directed and controlled by such foreign government or governments; 

4. a group engaged in international terrorism or activities in preparation therefor; 

5. a foreign-based political organization, not substantially composed of United States 
persons; or 

6. an entity that is directed or controlled by a foreign government or governments. 

H. HUMAN SOURCE: a Confidential Human Source as defined in the Attorney General’s 
Guidelines Regarding the Use of FBI Confidential Human Sources. 

I. INTELLIGENCE ACTIVITIES: any activity conducted for intelligence purposes or to 
affect political or governmental processes by, for, or on behalf of a foreign power. 

J. INTERNATIONAL TERRORISM: 

Activities that: 

1 . involve violent acts or acts dangerous to human life that violate federal, state, 
local, or tribal criminal law or would violate such law if committed within the 
United States or a state, local, or tribal jurisdiction; 

2. appear to be intended: 

i. to intimidate or coerce a civilian population; 

ii. to influence the policy of a government by intimidation or coercion; or 

iii. to affect the conduct of a government by assassination or kidnapping; and 

3. occur totally outside the United States, or transcend national boundaries in terms 
of the means by which they are accomplished, the persons they appear to be 
intended to coerce or intimidate, or the locale in which their perpetrators operate 
or seek asylum. 

K. PROPRIETARY : a sole proprietorship, partnership, corporation, or other business entity 
operated on a commercial basis, which is owned, controlled, or operated wholly or in part 
on behalf of the FBI, and whose relationship with the FBI is concealed from third parties. 
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L. - PUBLICLY AVAILABLE: information that has been published or broadcast for public 

consumption, is available on request to the public, is accessible on-line or otherwise to 
the public, is available to the public by subscription or purchase, could be seen or heard 
by any casual observer, is made available at a meeting open to the public, or is obtained 
by visiting any place or attending any event that is open to the public. 

M. RECORDS: any records, databases, files, indices, information systems, or other retained 
information. 

N. SENSITIVE INVESTIGATIVE MATTER: an investigative matter involving the 
activities of a domestic public official or political candidate (involving corruption or a 
threat to the national security), religious or political organization or individual prominent 
in such an organization, or news media, or any other matter which, in the judgment of the 
official authorizing an investigation, should be brought to the attention of FBI 
Headquarters and other Department of Justice officials. 

O. SENSITIVE MONITORING CIRCUMSTANCE: 

1 . investigation of a member of Congress, a federal judge, a member of the 
Executive Branch at Executive Level IV or above, or a person who has served in 
such capacity within the previous two years; 

2. investigation of the Governor, Lieutenant Governor, or Attorney General of any 
state or territory, or a judge or justice of the highest court of any state or territory, 
concerning an offense involving bribery, conflict of interest, or extortion related to 
the performance of official duties; 

3 . a party to the communication is in the custody of the Bureau of Prisons or the 
United States Marshals Service or is being or has been afforded protection in the 
Witness Security Program; or 

4. the Attorney General, the Deputy Attorney General, or an Assistant Attorney 
General has requested that the FBI obtain prior approval for the use of consensual 
monitoring in a specific investigation. 

P. SPECIAL AGENT IN CHARGE: the Special Agent in Charge of an FBI field office 
(including an Acting Special Agent in Charge), except that the functions authorized for 
Special Agents in Charge by these Guidelines may also be exercised by the Assistant 
Director in Charge or by any Special Agent in Charge designated by the Assistant 
Director in Charge in an FBI field office headed by an Assistant Director, and by FBI 
Headquarters officials designated by the Director of the FBI. 

Q. SPECIAL EVENTS MANAGEMENT: pla nnin g and conduct of public events or 
activities whose character may make them attractive targets for terrorist attack. 
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R. STATE, LOCAL, OR TRIBAL: any state or territory of the United States or political 
subdivision thereof, the District of Columbia, or Indian tribe. 

S. THREAT TO THE NATIONAL SECURITY: 

1. international terrorism; 

2. espionage and other intelligence activities, sabotage, and assassination, conducted 
by, for, or on behalf of foreign powers, organizations, or persons; 

3. foreign computer intrusion; and 

4. other matters determined by the Attorney General, consistent with Executive 
Order 12333 or a successor order. 

T. UNITED STATES: when used in a geographic sense, means all areas under the territorial 
sovereignty of the United States. 

U. UNITED STATES PERSON: 

Any of the following, but not including any association or corporation that is a foreign 
power as defined in Subpart G.I.-.3.: 

1 . an individual who is a United States citizen or an alien lawfully admitted for 
permanent residence; 

2. an unincorporated association substantially composed of individuals who are 
United States persons; or 

3 . a corporation incorporated in the United States. 

In applying paragraph 2., if a group or organization in the United States that is affiliated 
with a foreign-based international organization operates directly under the control of the 
international organization and has no independent program or activities in the United 
States, the membership of the entire international organization shall be considered in 
determining whether it is substantially composed of United States persons. If, however, 
the U.S.-based group or organization has programs or activities separate from, or in 
addition to, those directed by the international organization, only its membership in the 
United States shall be considered in determining whether it is substantially composed of 
United States persons. A classified directive provides further guidance concerning the 
determination of United States person status. 
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v. 


Date: 


USE: when used with respect to human sources, means obtaining information from, 
tasking, or otherwise operating such sources. 
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EXECUTIVE ORDER 
12333 


UNITED STATES INTELLIGENCE ACTIVITIES 
DECEMBER 4, 1981 

(AS AMENDED BY EXECUTIVE ORDERS 13284 (2003), 13355 (2004) 

AND 13470 (2008) ) 

PREAMBLE 

Timely, accurate, and insightful information about the 
activities, capabilities, plans, and intentions of foreign 
powers, organizations, and persons, and their agents, is 
essential to the national security of the United States. All 
reasonable and lawful means must be used to ensure that the 
United States will receive the best intelligence possible. For 
that purpose, by virtue of the authority vested in me by the 
Constitution and the laws of the United States of America, 
including the National Security Act of 1947, as amended, (Act) 
and as President of the United States of America, in order to 
provide for the effective conduct of United States intelligence 
activities and the protection of constitutional rights, it is 
hereby ordered as follows: 

PART 1 Goals, Directions , Duties , and Responsibilities with 
Respect to United States Intelligence Efforts 

1.1 Goals . The United States intelligence effort shall provide 
the President, the National Security Council, and the Homeland 
Security Council with the necessary information on which to base 
decisions concerning the development and conduct of foreign, 
defense, and economic policies, and the protection of 
United States national interests from foreign security threats. 
All departments and agencies shall cooperate fully to fulfill 
this goal. 

(a) All means, consistent with applicable Federal lav/ and 
this order, and with full consideration of the rights of 
United States persons, shall be used to obtain reliable 
intelligence information to protect the United States and its 
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interests . 

(b) The United States Government has a solemn obligation, 
and shall continue in the conduct of intelligence activities 
under this order, to protect fully the legal rights of all 
United States persons, including freedoms, civil liberties, and 
privacy rights guaranteed by Federal law. 

(c) Intelligence collection under this order should be 
guided by the need for information to respond to intelligence 
priorities set by the President. 

(d) Special emphasis should be given to detecting and 
countering: 

(1) Espionage and other threats and activities 
directed by foreign powers or their intelligence 
services against the United States and its interests; 

(2) Threats to the United States and its interests 
from terrorism; and 

(3) Threats to the United States and its interests 
from the development, possession, proliferation, or 
use of weapons of mass destruction. 

(e) Special emphasis shall be given to the production 
of timely, accurate, and insightful reports, responsive to 
decisionmakers in the executive branch, that draw on all 
appropriate sources of information, including open source 
information, meet rigorous analytic standards, consider 
diverse analytic viewpoints, and accurately represent 
appropriate alternative views. 

(f) State, local, and tribal governments are critical 
partners in securing and defending the United States from 
terrorism and other threats to the United States and its 
interests. Our national intelligence effort should take into 
account the responsibilities and requirements of State, local, 
and tribal governments and, as appropriate, private sector 
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entities, when undertaking the collection and dissemination of 
information and intelligence to protect the United States. 

(g) All departments and agencies have a responsibility 
to prepare and to provide intelligence in a manner that allows 
the full and free exchange of information, consistent with 
applicable law and presidential guidance. 

1.2 The National Security Council . 

(a) Purpose . The National Security Council (NSC) 
shall act as the highest ranking executive branch entity that 
provides support to the President for review of, guidance 
for, and direction to the conduct of all foreign intelligence, 
counterintelligence, and covert action, and attendant policies 
and programs . 

(b) Covert Action and Other Sensitive Intelligence 
Operations . The NSC shall consider and submit to the President 
a policy recommendation, including all dissents, on each 
proposed covert action and conduct a periodic review of ongoing 
covert action activities, including an evaluation of the 
effectiveness and consistency with current national policy 

of such activities and consistency with applicable legal 
requirements. The NSC shall perform such other functions 
related to covert action as the President may direct, but shall 
not undertake the conduct of covert actions. The NSC shall also 
review proposals for other sensitive intelligence operations. 

1.3 Director of National Intelligence . Subject to the 
authority, direction, and control of the President, the Director 
of National Intelligence (Director) shall serve as the head of 
the Intelligence Community, act as the principal adviser to the 
President, to the NSC, and to the Homeland Security Council 

for intelligence matters related to national security, and 
shall oversee and direct the implementation of the National 
Intelligence Program and execution of the National Intelligence 
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Program budget. The Director will lead a unified, coordinated, 
and effective intelligence effort. In addition, the Director 
shall, in carrying out the duties and responsibilities under 
this section, take into account the views of the heads of 
departments containing an element of the Intelligence Community 
and of the Director of the Central Intelligence Agency. 

(a) Except as otherwise directed by the President or 
prohibited by law, the Director shall have access to all 
information and intelligence described in section 1.5(a) of this 
order. For the purpose of access to and sharing of information 
and intelligence, the Director: 

(1) Is hereby assigned the function under 
section 3(5) of the Act, to determine that intelligence, 
regardless of the source from which derived and including 
information gathered within or outside the United States, 
pertains to more than one United States Government agency; and 

(2) Shall develop guidelines for how information 

or intelligence is provided to or accessed by the Intelligence 
Community in accordance with section 1.5(a) of this order, and 
for how the information or intelligence may be used and shared 
by the Intelligence Community. All guidelines developed in 
accordance with this section shall be approved by the Attorney 
General and, where applicable, shall be consistent with 
guidelines issued pursuant to section 1016 of the Intelligence 
Reform and Terrorism Protection Act of 2004 (Public Law 108-458) 
(IRTPA) . 

(b) In addition to fulfilling* the obligations and 
responsibilities prescribed by the Act, the Director: 

(1) Shall establish objectives, priorities, and 
guidance for the Intelligence Community to ensure timely and 
effective collection, processing, analysis, and dissemination of 
intelligence, of whatever nature and from whatever source 
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derived; 

(2) May designate, in consultation with affected 
heads of departments or Intelligence Community elements, one or 
more Intelligence Community elements to develop and to maintain 
services of common concern on behalf of the Intelligence 
Community if the Director determines such services can be more 
efficiently or effectively accomplished in a consolidated 
manner; 

(3) Shall oversee and provide advice to the 
President and the NSC with respect to all ongoing and proposed 
covert action programs; 

(4) In regard to the establishment and conduct of 
intelligence arrangements and agreements with foreign 
governments and international organizations: 

(A) May enter into intelligence and 
counterintelligence arrangements and agreements with foreign 
governments and international organizations; 

(B) Shall formulate policies concerning 
intelligence and counterintelligence arrangements and agreements 
with foreign governments and international organizations; and 

(C) Shall align and synchronize intelligence and 
counterintelligence foreign relationships among the elements of 
the Intelligence Community to further United States national 
security, policy, and intelligence objectives; 

(5) Shall participate in the development of 
procedures approved by the Attorney General governing criminal 
drug intelligence activities abroad to ensure that these 
activities are consistent with foreign intelligence programs; 

(6) Shall establish common security and access 
standards for managing and handling intelligence systems, 
information, and products, with special emphasis on 
facilitating : 
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(A) The fullest and most prompt access to and 
dissemination of information and intelligence practicable, 
assigning the highest priority to detecting, preventing, 
preempting, and disrupting terrorist threats and activities 
against the United States, its interests, and allies; and 

(B) The establishment of standards for an 
interoperable information sharing- enterprise that facilitates 
the sharing of intelligence information among elements of the 
Intelligence Community; 

(7) Shall ensure that appropriate departments and 
agencies have access to intelligence and receive the support 
needed to perform independent analysis; 

(8) Shall protect, and ensure that programs are 
developed to protect, intelligence sources, methods, and 
activities from unauthorized disclosure; 

(9) Shall, after consultation with the heads of 
affected departments and agencies, establish guidelines for 
Intelligence Community elements for; 

(A) Classification and declassification of all 
intelligence and intelligence-related information classified 
under the authority of the Director or the authority of the head 
of a department or Intelligence Community element; and 

(B) Access to and dissemination of all 
intelligence and intelligence-related information, both in its 
final form and in the form when initially gathered, to include 
intelligence originally classified by the head of a department 
or Intelligence Community element, except that access to and 
dissemination of information concerning United States persons 
shall be governed by procedures developed in accordance with 
Part 2 of this order; 

(10) May, only with respect to Intelligence 
Community elements, and after consultation with the head of the 
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originating Intelligence Community element or the head of the 
originating department, declassify, or direct the 
declassification of, information or intelligence relating to 
intelligence sources, methods, and activities. The Director may 
only delegate this authority to the Principal Deputy Director of 
National Intelligence; 

(11) May establish, operate, and direct one or more 
national intelligence centers to address intelligence 
priorities; 

(12) May establish Functional Managers and Mission 
Managers, and designate officers or employees of the 

United States to serve in these positions. 

(A) Functional Managers shall report to the 
Director concerning the execution of their duties as Functional 
Managers, and may be charged with developing and implementing 
strategic guidance, policies, and procedures for activities 
related to a specific intelligence discipline or set of 
intelligence activities; set training and tradecraft standards; 
and ensure coordination within and across intelligence 
disciplines and Intelligence Community elements and with related 
non-intelligence activities. Functional Managers may also 
advise the Director on: the management of resources; policies 

and procedures; collection capabilities and gaps; processing and 
dissemination of intelligence; technical architectures; and 
other issues or activities determined by the Director. 

(i) The Director of the National 
Security Agency is designated the Functional Manager for signals 
intelligence; 

(ii) The Director of the Central 
Intelligence Agency is designated the Functional Manager for 
human intelligence; and 

(iii) The Director of the National 
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Geospatial-Intelligence Agency is designated the Functional 
Manager for geospatial intelligence. 

(B) Mission Managers shall serve as principal 
substantive advisors on all or specified aspects of intelligence 
related to designated countries, regions, topics, or functional 
issues; 

(13) Shall establish uniform criteria for the 
determination of relative priorities for the transmission of 
critical foreign intelligence, and advise the Secretary of 
Defense concerning the communications requirements of the 
Intelligence Community for the transmission of such 
communications ; 

(14) Shall have ultimate responsibility for 
production and dissemination of intelligence produced by the 
Intelligence Community and authority to levy analytic tasks on 
intelligence production organizations within the Intelligence 
Community, in consultation with the heads of the Intelligence 
Community elements concerned; 

(15) May establish advisory groups for the purpose 
of obtaining advice from within the Intelligence Community to 
carry out the Director’s responsibilities, to include 
Intelligence Community executive management committees composed 
of senior Intelligence Community leaders. Advisory groups shall 
consist of representatives from elements of the Intelligence 
Community, as designated by the Director, or other executive 
branch departments, agencies, and offices, as appropriate; 

(16) Shall ensure the timely exploitation and 
dissemination of data gathered by national intelligence 
collection means, and ensure that the resulting intelligence is 
disseminated immediately to appropriate government elements, 
including military commands; 

(17) Shall determine requirements and priorities 
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for, and manage and direct the tasking, collection, analysis, 
production, and dissemination of, national intelligence by 
elements of the Intelligence Community, including approving 
requirements for collection and analysis and resolving conflicts 
in collection requirements and in the tasking of national 
collection assets of Intelligence Community elements (except 
when otherwise directed by the President or when the Secretary 
of Defense exercises collection tasking authority under plans 
and arrangements approved by the Secretary of Defense and the 
Director) ; 

(18) May provide advisory tasking concerning 
collection and analysis of information or intelligence relevant 
to national intelligence or national security to departments, 
agencies, and establishments of the United States Government 
that are not elements of the Intelligence Community; and shall 
establish 

procedures, in consultation with affected heads of 
departments or agencies and subject ro approval by the Attorney 
General, to implement this authority and to monitor or evaluate 
the responsiveness of United States Government departments, 
agencies, and other establishments; 

(19) Shall fulfill the responsibilities in 
section 1.3(b) (17) and (18) of this order, consistent with 
applicable law and with full consideration of the rights of 
United States persons, whether information is to be collected 
inside or outside the United States; 

(20) Shall ensure, through appropriate policies and 
procedures, the deconf liction, coordination, and integration of 
all intelligence activities conducted by an Intelligence 
Community element or funded by the National Intelligence 
Program. In accordance with these policies and procedures: 

(A) The Director of the Federal Bureau of 
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Investigation shall coordinate the clandestine collection of 
foreign intelligence collected through human sources or through 
human-enabled means and counterintelligence activities inside 
the United States; 

(B) The Director of the Central Intelligence 
Agency shall coordinate the clandestine collection of foreign 
intelligence collected through human sources or through human- 
enabled means and counterintelligence activities outside the 
United States; 

(C) All policies and procedures for the 
coordination of counterintelligence activities and the 
clandestine collection of foreign intelligence inside the 
United States shall be subject to the approval of the Attorney 
General; and 

(D) All policies and procedures developed under 
this section shall be coordinated with the heads of affected 
departments and Intelligence Community elements; 

(21) Shall, with the concurrence of the heads of 
affected departments and agencies, establish joint procedures to 
deconflict, coordinate, and synchronize intelligence activities 
conducted by an Intelligence Community element or funded by the 
National Intelligence Program, with intelligence activities, 
activities that involve foreign intelligence and security 
services, or activities that involve the use of clandestine 
methods, conducted by other United States Government 
departments, agencies, and establishments; 

(22) Shall, in coordination with the heads of 
departments containing elements of the Intelligence Community, 
develop procedures to govern major system acquisitions funded in 
whole or in majority part by the National Intelligence Program; 

(23) Shall seek advice from the Secretary of State 
to ensure that the foreign policy implications of proposed 
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intelligence activities are considered, and shall ensure, 
through appropriate policies and procedures, that intelligence 
activities are conducted in a manner consistent with the 
responsibilities pursuant to law and presidential direction of 
Chiefs of United States Missions; and 

(24) Shall facilitate the use of Intelligence 
Community products by the Congress in a secure manner. 

(c) The Director's exercise of authorities in the 
Act and this order shall not abrogate the statutory or 
other responsibilities of the heads of departments of the 
United States Government or the Director of the Central 
Intelligence Agency. Directives issued and actions taken by 
the Director in the exercise of the Director's authorities 
and responsibilities to integrate, coordinate, and make the 
Intelligence Community more effective in providing intelligence 
related to national security shall be implemented by the 
elements of the Intelligence Community, provided that any 
department head whose department contains an element of the 
Intelligence Community and who believes that a directive or 
action of the Director violates the requirements of section 1018 
of the IRTPA or this subsection shall bring the issue to the 
attention of the Director, the NSC, or the President for 
resolution in a manner that respects and does not abrogate the 
statutory responsibilities of the heads of the departments. 

(d) Appointments to certain positions. 

(1) The relevant department or bureau head shall 
provide recommendations and obtain the concurrence of the 
Director for the selection of: the Director of the National 

Security Agency, the Director of the National Reconnaissance 
Office, the Director of the National Geospatial-Intelligence 
Agency, the Under Secretary of Homeland Security for 
Intelligence and Analysis, the Assistant Secretary of State for 
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Intelligence and Research, the Director of the Office of 
Intelligence and Counterintelligence of the Department of 
Energy, the Assistant Secretary for Intelligence and Analysis of 
the Department of the Treasury, and the Executive Assistant 
Director for the National Security Branch of the Federal Bureau 
of Investigation. If the Director does not concur in the 
recommendation, the department head may not fill the vacancy or 
make the recommendation to the President, as the case may be. 

If the department head and the Director do not reach an 
agreement on the selection or recommendation, the Director and 
the department head concerned may advise the President directly 
of the Director’s intention to withhold concurrence. 

(2) The relevant department head shall consult with 
the Director before appointing an individual to fill a vacancy 
or recommending to the President an individual be nominated to 
fill a vacancy in any of the following positions: the Under 

Secretary of Defense for Intelligence/ the Director of the 
Defense Intelligence Agency; uniformed heads of the intelligence 
elements of the Army, the Navy, the Air Force, and the Marine 
Corps above the rank of Major General or Rear Admiral; the 
Assistant Commandant of the Coast Guard for Intelligence; and 
the Assistant Attorney General for National Security. 

(e) Removal from certain positions. 

(1) Except for the Director of the Central 
Intelligence Agency, who se removal the Director may recommend to 
the President, the Director and the relevant department head 
shall consult on the removal, or recommendation to the President 
for removal, as the case may be, of: the Director of the 

National Security Agency, the Director of the National 
Geospatial-Intelligence Agency, the Director of the Defense 
Intelligence Agency, the Under Secretary of Homeland Security 
for Intelligence and Analysis, the Assistant Secretary of State 
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for Intelligence and Research, and the Assistant Secretary for 
Intelligence and Analysis of the Department of the Treasury. If 
the Director and the department head do not agree on removal, or 
recommendation for removal, either may make a recommendation to 
the President for the removal of the individual. 

(2) The Director and the relevant department or 

bureau head shall consult on the removal of: the Executive 

Assistant Director for the National Security Branch of the 
Federal Bureau of Investigation, the Director of the Office of 
Intelligence and Counterintelligence of the Department of 
Energy, the Director of the National Reconnaissance Office, 
the Assistant Commandant of the Coast Guard for Intelligence, 
and the Under Secretary of Defense for Intelligence. With 
respect to an individual appointed by a department head, the 
department head may remove the individual upon the request of 
the Director; if the department head chooses not to remove the 
individual, either the Director or the department head may 
advise the President of the department head’s intention to 
retain the individual. In the case of the Under Secretary of 
Defense for Intelligence, the Secretary of Defense may recommend 
to the President either the removal or the retention of the 
individual. For uniformed heads of the intelligence elements of 
the Army, the Navy, the Air Force, and the Marine Corps, the 
Director may make a recommendation for removal to the Secretary 
of Defense. 

(3) Nothing in this subsection shall be construed 
to limit or otherwise affect the authority of the President to 
nominate, appoint, assign, or terminate the appointment or 
assignment of any individual, with or without a consultation, 
recommendation, or concurrence. 

1.4 The Intelligence Community. Consistent with applicable 
Federal law and with the other provisions of this order, and 
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under the leadership of the Director, as specified in- such law 
and this order, the Intelligence Community shall: 

(a) Collect and provide information needed by the 
President and, in the performance of executive functions, the 
Vice President, the NSC, the Homeland Security Council, the 
Chairman of the Joint Chiefs of Staff, senior military 
commanders, and other executive branch officials and, as 
appropriate, the Congress of the United States; 

(b) In accordance with priorities set by the President, 
collect information concerning, and conduct activities to 
protect against, international terrorism, proliferation of 
weapons of mass destruction, intelligence activities directed 
against the United States, international criminal drug 
activities, and other hostile activities directed against the 
United States by foreign powers, organizations, persons, and 
their agents; 

(c) Analyze, produce, and disseminate intelligence; 

(d) Conduct administrative, technical, and other support 
activities within the United States and abroad necessary for 
the performance of authorized activities, to include providing 
services of common concern for the Intelligence Community as 
designated by the Director in accordance with this order; 

(e) Conduct research, development, and procurement of 
technical systems and devices relating to authorized functions 
and missions or the provision of services of common concern for 
the Intelligence Community; 

(f) Protect the security of intelligence related 
activities, information, installations, property, and employees 
by appropriate means, including such investigations of 
applicants, employees, contractors, and other persons with 
similar associations with the Intelligence Community elements as 
are necessary; 
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(g) Take into account: State, local-, and tribal 
governments’ and, as appropriate, private sector entities' 
information needs relating to national and homeland security; 

(h) Deconflict, coordinate, and integrate all intelligence 
activities and other information gathering in accordance with 
section 1.3(b) (20) of this order; and 

(i) Perform such other functions and duties related to 
intelligence activities as the President may direct. 

1.5 Duties and Responsibilities of the Heads of Executive 
Branch Departments and Agencies . The heads of all departments 
and agencies shall : 

(a) Provide the Director access to all information and 
intelligence relevant to the national security or that otherwise 
is required for the performance of the Director's duties, 

to include administrative and other appropriate management 
information, except such information excluded by law, by the 
President, or by the Attorney General acting under this order 
at the direction of the President; 

(b) Provide all programmatic and budgetary information 
necessary to support the Director in developing the National 
Intelligence Program; 

(c) Coordinate development and implementation of 
intelligence systems and architectures and, as appropriate, 
operational systems and architectures of their departments, 
agencies, and other elements with the Director to respond 
to national intelligence requirements and all applicable 
information sharing and security guidelines, information 
privacy, and other legal requirements; 

(d) Provide, to the maximum extent permitted by 
law, subject to the availability of appropriations and not 
inconsistent with the mission of the department or agency, such 
further support to the Director as the Director may request, 
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after consultation with the head of the department or agency, 
for the performance of the Director's functions; 

(e) Respond to advisory tasking from the Director 
under section 1.3(b) (18) of this order to the greatest extent 
possible, in accordance with applicable policies established 
by the head of the responding department or agency; 

(f) Ensure that all elements within the department 

or agency comply with the provisions of Part 2 of this order, 
regardless of Intelligence Community affiliation, when 
performing foreign intelligence and counterintelligence 
functions ; 

(g) Deconflict, coordinate, and integrate all 
intelligence activities in accordance with section 1.3(b) (20), 
and intelligence and other activities in accordance with 
section 1.3(b) (21) of this order; 

(h) Inform the Attorney General, either directly or 
through the Federal Bureau of Investigation, and the Director 
of clandestine collection of foreign intelligence and 
counterintelligence activities inside the United States not 
coordinated with the Federal Bureau of Investigation; 

(i) Pursuant to arrangements developed by the head of 
the department or agency and the Director of the Central 
Intelligence Agency and approved by the Director, inform the 
Director and the Director of the Central Intelligence Agency, 
either directly or through his designee serving outside the 
United States, as appropriate, of clandestine collection of 
foreign intelligence collected through human sources or through 
human-enabled means outside the United States that has not been 
coordinated with the Central Intelligence Agency; and 

(j) Inform the Secretary of Defense, either directly or 
through his designee, as appropriate, of clandestine collection 
of foreign intelligence outside the United States in a region of 
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combat or contingency military operations designated by the 
Secretary of Defense, for purposes of this paragraph, after 
consultation with the Director of National Intelligence. 

1.6 Heads of Elements of the Intelligence Community . The heads 
of elements of the Intelligence Community shall: 

(a) Provide the Director access to all information and 
intelligence relevant to the national security or that otherwise 
is required for the performance of the Director's duties, 

to include administrative and other appropriate management 
information, except such information excluded by law, by the 
President, or by the Attorney General acting under this order 
at the direction of the President; 

(b) Report to the Attorney General possible violations 
of Federal criminal laws by employees and of specified Federal 
criminal laws by any other person as provided in procedures 
agreed upon by the Attorney General and the head of the 
department, agency, or establishment concerned, in a manner 
consistent w ith the protection of intelligence sources and 
methods, as specified in those procedures; 

(c) Report to the Intelligence Oversight Board, consistent 
with Executive Order 13462 of February 29, 2008, and provide 
copies of all such reports to the Director, concerning any 
intelligence activities of their elements that they have reason 
to believe may be unlawful or contrary to executive order or 
presidential directive; 

(d) Protect intelligence and intelligence sources, 
methods, and activities from unauthorized disclosure in 
accordance with guidance from the Director; 

(e) Facilitate, as appropriate, the sharing of information 
or intelligence, as directed by law or the President, to State, 
local, tribal, and private sector entities; 

(f) Disseminate information or intelligence to foreign 
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governments and international organizations under intelligence 
or counterintelligence arrangements or agreements established in 
accordance with section 1.3(b) (4) of this order; 

(g) Participate in the development of procedures approved 
by the Attorney General governing production and dissemination 
of information or intelligence resulting from criminal drug 
intelligence activities abroad if they have intelligence 
responsibilities for foreign or domestic criminal drug 
production and trafficking; and 

(h) Ensure that the inspectors general , general counsels, 
and agency officials responsible for privacy or civil liberties 
protection for their respective organizations have access to any 
information or intelligence necessary to perform their official 
duties . 

1.7 Intelligence Community Elements . Each element of 
the Intelligence Community shall have the duties and 
responsibilities specified below, in addition to those 
specified by law or elsewhere in this order. Intelligence 
Community elements within executive departments shall serve the 
information and intelligence needs of their respective heads 
of departments and also shall operate as part of an integrated 
Intelligence Community, as provided in law or this order. 

(a) THE CENTRAL INTELLIGENCE AGENCY. The Director of the 
Central Intelligence Agency shall: 

(1) Collect (including through clandestine means) , 
analyze, produce, and disseminate foreign intelligence and 
counterintelligence; 

(2) Conduct counterintelligence activities without 
assuming or performing any internal security functions within 
the United States; 

(3) Conduct administrative and technical support 
activities within and outside the United States as necessary for 
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cover and proprietary arrangements/ 

(4) Conduct covert action activities approved by the 
President. No agency except the Central Intelligence Agency (or 
the Armed Forces of the United States in time of war declared by 
the Congress or during any period covered by a report from the 
President to the Congress consistent with the War Powers 
Resolution, Public Law 93-148) may conduct any covert action 
activity unless the President determines that another agency is 
more likely to achieve a particular objective; 

(5) Conduct foreign intelligence liaison 
relationships with intelligence or security services of foreign 
governments or international organizations consistent with 
section 1.3(b)(4) of this order; 

(6) Under the direction and guidance of the Director, 
and in accordance with section 1.3(b) (4) of this order, 
coordinate the implementation of intelligence and 
counterintelligence relationships between elements of the 
Intelligence Community and the intelligence or security services 
of foreign governments or international organizations; and 

(7) Perform such other functions and duties related 
to intelligence as the Director may direct. 

(b) THE DEFENSE INTELLIGENCE AGENCY. The Director of the 
Defense Intelligence A.gency shall: 

(1) Collect (including through clandestine means), 
analyze, produce, and disseminate foreign intelligence and 
counterintelligence to support national and departmental 
missions; 

(2) . Collect, analyze, produce, or, through tasking 
and coordination, provide defense and defense-related 
intelligence for the Secretary of Defense, the Chairman of the 
Joint Chiefs of Staff, combatant commanders, other Defense 
components, and non-Defense agencies; 
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(3) Conduct counterintelligence activities; 

(4) Conduct administrative and technical support 
activities within and outside the United States as necessary for 
cover and proprietary arrangements; 

(5) Conduct foreign defense intelligence liaison 
relationships and defense intelligence exchange programs with 
foreign defense establishments, intelligence or security 
services of foreign governments, and international organizations 
in accordance with sections 1.3(b)(4), 1.7(a)(6), and 1.10(1) of 
this order; 

(6) Manage and coordinate all matters related to the 
Defense Attache system; and 

(7) Provide foreign intelligence and 
counterintelligence staff support as directed by the Secretary 
of Defense. 

(c) THE NATIONAL SECURITY AGENCY. The Director of the 
National Security Agency shall: 

(1) Collect (including through clandestine means), 
process, analyze, produce, and disseminate signals intelligence 
information and data for foreign intelligence and 
counterintelligence purposes to support national and 
departmental missions; 

(2) Establish and operate an effective unified 
organization for signals intelligence activities, except for the 
delegation of operational control over certain operations that 
are conducted through other elements of the Intelligence 
Community. No other department or agency may engage in signals 
intelligence activities except pursuant to a delegation by the 
Secretary of Defense, after coordination with the Director; 

(3) Control signals intelligence collection and 
processing activities, including assignment of resources to an 
appropriate agent for such periods and tasks as required for the 
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direct support of military commanders; 

(4) Conduct administrative and technical support 
activities within and outside the United States as necessary for 
cover arrangements; 

(5) Provide signals intelligence support for national 
and departmental requirements and for the conduct of military 
operations; 

(6) Act as the National Manager for National Security 
Systems as established in lav/ and policy/ and in this capacity 
be responsible to the Secretary of Defense and to the Director; 

(7) Prescribe, consistent with section 102A(g) of 
the Act, within its field of authorized operations, security 
regulations covering operating practices, including the 
transmission, handling, and distribution of signals intelligence 
and communications security material within and among the 
elements under control of the Director of the National Security 
Agency, and exercise the necessary supervisory control to ensure 
compliance with the regulations; and 

(8) Conduct foreign cryptologic liaison relationships 
in accordance with sections 1.3(b)(4), 1.7(a)(6), and 1.10 (i) of 
this order. 

(d) THE NATIONAL RECONNAISSANCE OFFICE. The Director of 
the National Reconnaissance Office shall: 

(1) Be responsible for research and development, 
acquisition, launch, deployment, and operation of overhead 
systems and related data processing facilities to collect 
intelligence and information to support national and 
departmental missions and other United States Government needs; 
and 

(2) Conduct foreign liaison relationships relating 
to the above missions, in accordance with sections 1.3(b) (4), 
1.7(a) (6), and 1.10 (i) of this order. 


21 

B-22 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 


Version Dated: 
October 15, 2011 


UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 

(e) THE NATIONAL GEOSPATIAL-INTELLIGENCE AGENCY. The 
Director of the National Geospatial-Intelligence Agency shall: 

(1) Collect,- process, analyze, produce, and 
disseminate geospatial intelligence information and data for 
foreign intelligence and counterintelligence purposes to support 
national and departmental missions; 

(2) Provide geospatial intelligence support for 
national and departmental requirements and for the conduct of 
military operations; 

(3) Conduct administrative and technical support 
activities within and outside the United States as necessary for 
cover arrangements; and 

(4) Conduct foreign geospatial intelligence liaison 
relationships, in accordance with sections 1.3(b) (4), 1.7(a) (6), 
and 1.10 (i) of this order. 

(f) THE INTELLIGENCE AND COUNTERINTELLIGENCE ELEMENTS OF 
THE ARMY, NAVY, AIR FORCE, AND MARINE CORPS. The Commanders and 
heads of the intelligence and counterintelligence elements of 
the Army, Navy, Air Force, and Marine Corps shall: 

(1) Collect (including through clandestine means) , 
produce, analyze, and disseminate defense and defense-related 
intelligence and counterintelligence to support departmental 
requirements, and, as appropriate, national requirements; 

(2) Conduct counterintelligence activities; 

(3) Monitor the development, procurement, and 
management of tactical intelligence systems and equipment and 
conduct related research, development, and test and evaluation 
activities'; and 

(4) Conduct military intelligence liaison 
relationships and military intelligence exchange programs with 
selected cooperative foreign defense establishments and 
international organizations in accordance with 
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sections 1.3(b)(4), 1.7(a)(6), and 1.10(i) of this order. 

(g) INTELLIGENCE ELEMENTS OF THE FEDERAL BUREAU OF 
INVESTIGATION. Under the supervision of the Attorney General 
and pursuant to such regulations as the Attorney General may 
establish, the intelligence elements of the Federal Bureau of 
Investigation shall: 

(1) Collect (including through clandestine means), 
analyze, produce, and disseminate foreign intelligence and 
counterintelligence to support national and departmental 
missions, in accordance with procedural guidelines approved by 
the Attorney General, after consultation with the Director; 

(2) Conduct counterintelligence activities; and 

(3) Conduct foreign intelligence and 
counterintelligence liaison relationships with intelligence, 
security, and lav; enforcement services of foreign governments or 
international organizations in accordance with 

sections 1.3(b)(4) and 1.7(a) (6) of this order. 

(h) THE INTELLIGENCE AND COUNTERINTELLIGENCE ELEMENTS OF 
THE COAST GUARD. The Commandant of the Coast Guard shall: 

(1) Collect (including through clandestine means), 
analyze, produce, and disseminate foreign intelligence and 
counterintelligence including defense and defense-related 
information and intelligence to support national and 
departmental missions; 

(2) Conduct counterintelligence activities; 

(3) Monitor the development, procurement, and 
management of tactical intelligence systems and equipment and 
conduct related research, development, and test and evaluation 
activities; and 

(4) Conduct foreign intelligence liaison 
relationships and intelligence exchange programs with foreign 
intelligence services, security services or international 
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organizations in accordance with sections 1.3(b)(4), 1.7(a)(6), 
and, when operating as part of the Department of Defense, 

1.10(i) of this order. 

(i) THE BUREAU OF INTELLIGENCE AND RESEARCH, DEPARTMENT OF 
STATE; THE OFFICE OF INTELLIGENCE AND ANALYSIS, DEPARTMENT OF 
THE TREASURY; THE OFFICE OF NATIONAL SECURITY INTELLIGENCE, DRUG 
ENFORCEMENT ADMINISTRATION; THE OFFICE OF INTELLIGENCE AND 
ANALYSIS, DEPARTMENT OF HOMELAND SECURITY; AND THE OFFICE OF 
INTELLIGENCE AND COUNTERINTELLIGENCE, DEPARTMENT OF ENERGY. 

The heads of the Bureau of Intelligence and Research, Department 
of State; the Office of Intelligence and Analysis, Department 
of the Treasury; the Office of National Security Intelligence, 
Drug Enforcement Administration; the Office of Intelligence and 
Analysis, Department of Homeland Security; and the Office of 
Intelligence and Counterintelligence, Department of Energy 
shall: 

(1) Collect (overtly or through publicly available 
sources) , analyze, produce, and disseminate information, 
intelligence, and counterintelligence to support national and 
departmental missions; and 

(2) Conduct and participate in analytic or 
information exchanges with foreign partners and international 
organizations in accordance with sections 1.3(b) (4) and 
1.7(a) (6) of this order. 

(j) THE OFFICE OF THE DIRECTOR OF NATIONAL INTELLIGENCE. 
The Director shall collect (overtly or through publicly 
available sources) , analyze, produce, and disseminate 
information, intelligence, and counterintelligence to support 
the missions of the Office of the Director of National 
Intelligence, including the National Counterterrorism Center, 
and to support other national missions. 

1.8 The Department of State. In addition to the authorities 
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exercised by the Bureau of Intelligence and Research under 
sections 1.4 and 1.7 (i) of this order, the Secretary of State 
shall : 

(a) Collect (overtly or through publicly available 
sources) information relevant to United States foreign policy 
and national security concerns; 

(b) Disseminate, to the maximum extent possible, reports 
received from United States diplomatic and consular posts; 

(c) Transmit reporting requirements and advisory taskings 
of the Intelligence Community to the Chiefs of United States 
Missions abroad; and 

(d) Support Chiefs of United States Missions in 
discharging their responsibilities pursuant to law and 
presidential direction. 

1.9 The Department of the Treasury. In addition to the 
authorities exercised by the Office of Intelligence and Analysis 
of the Department of the Treasury under sections 1.4 and 1.7 (i) 
of this order the Secretary of the Treasury shall collect 
(overtly or through publicly available sources) foreign 
financial information and, in consultation with the Department 
of State, foreign economic information. 

1.10 The Department of Defense. The Secretary of Defense 
shall: 

(a) Collect (including through clandestine means) , 
analyze, produce, and disseminate information and intelligence 
and be responsive to collection tasking and advisory tasking by 
the Director; 

(b) Collect (including through clandestine means) , 
analyze, produce, and disseminate defense and defense-related 
intelligence and counterintelligence, as required for execution 
of the Secretary's responsibilities; 

(c) Conduct programs and missions necessary to fulfill 
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national, departmental, and tactical intelligence requirements; 

(d) Conduct counterintelligence activities in support 
of Department of Defense components and coordinate 
counterintelligence activities in accordance with 
section 1.3(b) (20) and (21) of this order; 

(e) Act, in coordination with the Director, as the 
executive agent of the United States Government for signals 
intelligence activities; 

(f) Provide for the timely transmission of critical 
intelligence, as defined by the Director, within the 
United States Government; 

(g) Carry out or contract for research, development, 
and procurement of technical systems and devices relating to 
authorized intelligence functions; 

(h) Protect the security of Department of Defense 
installations, activities, information, property, and 
employees by appropriate means, including such investigations 
of applicants, employees, contractors, and other persons with 
similar associations with the Department of Defense as are 
necessary; 

(i) Establish and maintain defense intelligence 
relationships and defense intelligence exchange programs 
with selected cooperative foreign defense establishments, 
intelligence or security services of foreign governments, and 
international organizations, and ensure that such relationships 
and programs are in accordance with sections 1.3(b) (4), 

1.3(b) (21) and 1.7(a) (6) of this order; 

(j) Conduct such administrative and technical support 
activities within and outside the United States as are necessary 
to provide for cover and proprietary arrangements, to perform 
the functions described in sections (a) though (i) above, and to 
support the Intelligence Community elements of the Department of 


26 

B-27 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 


Version Dated: 
October 15, 2011 


UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 


Defense; and 

(k) Use the Intelligence Community elements within the 
Department of Defense identified in section 1.7(b) through (f) 
and, when the Coast Guard is operating as part of the Department 
of Defense, 

(h) above to carry out the Secretary of Defense* s 
responsibilities assigned in this section or other departments, 
agencies, or offices within the Department of Defense, as 
appropriate, to conduct the intelligence missions and 
responsibilities assigned to the Secretary of Defense. 

1.11 The Department of Homeland Security . In addition to the 
authorities exercised by the Office of Intelligence and Analysis 
of the Department of Homeland Security under sections 1.4 and 
1.7 (i) of this order, the Secretary of Homeland Security shall 
conduct, through the United States Secret Service, activities to 
determine the existence and capability of surveillance equipment 
being used against the President or the Vice President of the 
United States, the Executive Office of the President, and, 

as authorized by the Secretary of Homeland Security or the 
President, other Secret Service protectees and United States 
officials. No information shall be acquired intentionally 
through such activities except to protect against use of such 
surveillance equipment, and those activities shall be conducted 
pursuant to procedures agreed upon by the Secretary of Homeland 
Security and the Attorney General. 

1.12 The Department of Energy. In addition to the authorities 
exercised by the Office of Intelligence and Counterintelligence 
of the Department of Energy under sections 1.4 and 1.7 (i) of 
this order, the Secretary of Energy shall: 

(a) Provide expert scientific, technical, analytic, and 
research capabilities to other agencies within the Intelligence 
Community, as appropriate; 
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•(b) Participate in formulating intelligence collection and 
analysis requirements where the special expert capability of the 
Department can contribute; and 

(c) Participate with the Department of State in overtly 
collecting information with respect to foreign energy matters. 
1.13 The Federal Bureau of Investigation . In addition to the 
authorities exercised by the intelligence elements of the 
Federal Bureau of Investigation of the Department of Justice 
under sections 1.4 and 1.7(g) of this order and under the 
supervision of the Attorney General and pursuant to such 
regulations as the Attorney General may establish, the Director 
of the Federal Bureau of Investigation shall provide technical 
assistance, within or outside the United States, to foreign 
intelligence and law enforcement services, consistent with 
section 1.3(b) (20) and (21) of this order, as may be necessary 
to support national or departmental missions. 

PART 2 Conduct of Intelligence Activities 

2.1 Need . Timely, accurate, and insightful information about 
the activities, capabilities, plans, and intentions of foreign 
powers, organizations, and persons, and their agents, is 
essential to informed decisionmaking in the areas of national 
security, national defense, and foreign relations. Collection 
of such information is a priority objective and will be pursued 
in a vigorous, innovative, and responsible manner that is 
consistent with the Constitution and applicable lav; and 
respectful of the principles upon which the United States was 
founded. 

2.2 Purpose. This Order is intended to enhance human and 
technical collection techniques, especially those undertaken 
abroad, and the acquisition of significant foreign intelligence, 
as well as the detection and countering of international 
terrorist activities, the spread of weapons of mass destruction, 
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and espionage conducted by foreign powers. Set forth below are 
certain general principles that,, in addition to and consistent 
with applicable laws, are intended to achieve the proper balance 
between the acquisition of essential information and protection 
of individual interests. Nothing in this Order shall be 
construed to apply to or interfere with any authorized civil or 
criminal law enforcement responsibility of any department or 
agency. 

2.3 Collection of information . Elements of the Intelligence 
Community are authorized to collect, retain, or disseminate 
information concerning United States persons only in accordance 
with procedures established by the head of the Intelligence 
Community element concerned or by the head of a department 
containing such element and approved by the Attorney General, 
consistent with the authorities provided by Part 1 of this 
Order, after consultation with the Director. Those procedures 
shall permit collection, retention, and dissemination of the 
following types of information: 

(a) Information that is publicly available or collected 
with the consent of the person concerned; 

(b) Information constituting foreign intelligence or 
counterintelligence, including such information concerning 
corporations or other commercial organizations. Collection 
within the United States of foreign intelligence not otherwise 
obtainable shall be undertaken by the Federal Bureau of 
Investigation (FBI) or, when significant foreign intelligence is 
sought, by other authorized elements of the Intelligence 
Community, provided that no foreign intelligence collection by 
such elements may be undertaken for the purpose of acquiring 
information concerning the domestic activities of United States 
persons; 

(c) Information obtained in the course of a lawful foreign 
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intelligence, counterintelligence, international drug or 
international terrorism investigation; 

(d) Information needed to protect the safety of any persons 
or organizations, including those who are targets, victims, or 
hostages of international terrorist organizations; 

(e) Information needed to protect foreign intelligence or 
counterintelligence sources, methods, and activities from 
unauthorized disclosure. Collection within the United States 
shall be undertaken by the FBI except that other elements of the 
Intelligence Community may also collect such information 
concerning present or former employees, present or former 
intelligence element contractors or their present or former 
employees, or applicants for such employment or contracting; 

(f) Information concerning persons who are reasonably 
believed to be potential sources or contacts for the purpose of 
determining their suitability or credibility; 

(g) Information arising out of a lawful personnel, 
physical, or communications security investigation; 

(h) Information acquired by overhead reconnaissance not 
directed at specific United States persons; 

(i) Incidentally obtained information that may indicate 
involvement in activities that may violate Federal, state, 
local, or foreign laws; and 

(j) Information necessary for administrative purposes. 

In addition, elements of the Intelligence Community may 

disseminate information to each appropriate element within the 
Intelligence Community for purposes of allowing the recipient 
element to determine whether the information is relevant to its 
responsibilities and can be retained by it, except that 
information derived from signals intelligence may only be 
disseminated or made available to Intelligence Community 
elements in accordance with procedures established by the 
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Director in coordination with the Secretary of Defense and 
approved by the Attorney General. 

2.4 Collection Techniques. Elements of the Intelligence 
Community shall use the least intrusive collection techniques 
feasible within the United States or directed against 
United States persons abroad. Elements of the Intelligence 
Community are not authorized to use such techniques as 
electronic surveillance, unconsented physical searches, mail 
surveillance, physical surveillance, or monitoring devices 
unless they are in accordance with procedures established by the 
head of the Intelligence Community element concerned or the head 
of a department containing such element and approved by the 
Attorney General, after consultation with the Director. Such 
procedures shall protect constitutional and other legal rights 
and limit use of such information to lawful governmental 
purposes. These procedures shall not authorize: 

(a) The Central Intelligence Agency (CIA) to engage in 
electronic surveillance within the United States except for the 
purpose of training, testing, or conducting countermeasures to 
hostile electronic surveillance; 

(b) Unconsented physical searches in the United States by 
elements of the Intelligence Community other than the FBI, 
except for: 

(1) Searches by counterintelligence elements of the 
military services directed against military personnel within the 
United States or abroad for intelligence purposes, when 
authorized by a military commander empower ed to approve physical 
searches for law enforcement purposes, based upon a finding of 
probable cause to believe that such persons are acting as agents 
of foreign powers; and 

(2) Searches by CIA of personal property of non- 
United States persons lawfully in its possession; 
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(c) Physical surveillance of a United States person in the 
United States by elements of the Intelligence Community other 
than the FBI, except for: 

(1) Physical surveillance of present or former 
employees, present or former intelligence element contractors or 
their present or former employees, or applicants for any such 
employment or contracting; and 

(2) Physical surveillance of a military person 
employed by a non-intelligence element of a military service; 
and 

(d) Physical surveillance of a United State's person abroad 
to collect foreign intelligence, except to obtain significant 
information that cannot reasonably be acquired by other means. 

2.5 Attorney General Approval . The Attorney General hereby is 
delegated the power to approve the use for intelligence 
purposes, within the United States or against a United States 
person abroad, of any technique for which a warrant would be 
required if undertaken for law enforcement purposes, provided 
that such techniques shall not be undertaken unless the Attorney 
General has determined in each case that there is probable cause 
to believe that the technique is directed against a foreign 
power or an agent of a foreign power. The authority delegated 
pursuant to this paragraph, including the authority to approve 
the use of electronic surveillance as defined in the Foreign 
Intelligence Surveillance Act of 1978, as amended, shall be 
exercised in accordance with that Act. 

2.6 Assistance to Lav/ Enforcement and other Civil Authorities . 
Elements of the Intelligence Community are authorized to: 

(a) Cooperate with appropriate law enforcement agencies for 
the purpose of protecting the employees, information, property, 
and facilities of any element of the Intelligence Community; 

(b) Unless otherwise precluded by law or this Order, 
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participate in law enforcement activities to investigate or 
prevent clandestine intelligence activities by foreign powers, 
or international terrorist or narcotics activities; 

(c) Provide specialized equipment, technical knowledge, or 
assistance of expert personnel for use by any department or 
agency, or when lives are endangered, to support local law 
enforcement agencies. Provision of assistance by expert 
personnel shall be approved in each case by the general counsel 
of the providing element or department; and 

(d) Render any other assistance and cooperation to law 
enforcement or other civil authorities not precluded by 
applicable law. 

2.7 Contracting. Elements of the Intelligence Community are 
authorized to enter into contracts or arrangements for the 
provision of goods or services with private companies or 
institutions in the United States and need not reveal the 
sponsorship of such contracts or arrangements for authorized 
intelligence purposes. Contracts or arrangements with academic 
institutions may be undertaken only with the consent of 
appropriate officials of the institution. 

2.8 Consistency With Other Laws. Nothing in this Order shall be 
construed to authorize any activity in violation of the 
Constitution or statutes of the United States. 

2.9 Undisclosed Participation in Organizations Within the 
United States . No one acting on behalf of elements of the 
Intelligence Community may join or otherwise participate in any 
organization in the United States on behalf of any element of 
the Intelligence Community without disclosing such person's 
intelligence affiliation to appropriate officials of the 
organization, except in accordance with procedures established 
by the head of the Intelligence Community element concerned or 
the head of a department containing such element and approved by 
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the Attorney General, after consultation with the Director. 

Such participation shall be authorized only if it is essential 
to achieving lawful purposes as determined by the Intelligence 
Community element head or designee. No such participation may 
be undertaken for the purpose of influencing the activity of the 
organization or its members except in cases where: 

(a) The participation is undertaken on behalf of the FBI in 
the course of a lawful investigation; or 

(b) The organization concerned is composed primarily of 
individuals who are not United States persons and is reasonably 
believed to be acting on behalf of a foreign power. 

2.10 Human Experimentation . No element of the Intelligence 
Community shall sponsor, contract for, or conduct research on 
human subjects except in accordance with guidelines issued by 
the Department of Health and Human Services. The subject's 
informed consent shall be documented as required by those 
guidelines . 

2.11 Prohibition on Assassination . No person employed by or 
acting on behalf of the United States Government shall engage in 
or conspire to engage in assassination. 

2.12 Indirect Participation. No element of the Intelligence 
Community shall participate in or request any person to 
undertake activities forbidden by this Order. 

2.13 Limitation on Covert Action , No covert action may be 
conducted which is intended to influence United States political 
processes, public opinion, policies, or media. 

PART 3 General Provisions 

3.1 Congressional Oversight . The duties and responsibilities of 
the Director and the heads of other departments, agencies, 
elements, and entities engaged in intelligence activities to 
cooperate with the Congress in the conduct of its 
responsibilities for oversight of intelligence activities shall 
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be implemented in accordance with applicable law, including 
title V of the Act. The requirements of applicable lav;, 
including title V of the Act, shall apply to all covert action 
activities as defined in this Order. 

3.2 Implementation. The President, supported by the NSC, 
and the Director shall issue such appropriate directives, 
procedures, and guidance as are necessary to implement this 
order. Heads of elements within the Intelligence Community 
shall issue appropriate procedures and supplementary directives 
consistent with this order. No procedures to implement Part 2 
of this order shall be issued without the Attorney General's 
approval, after consultation with the Director. The Attorney 
General shall provide a statement of reasons for not approving 
any procedures established by the head of an element in the 
Intelligence Community (or the head of the department containing 
such element) other than the FBI . In instances where the 
element head or department head and the Attorney General are 
unable to reach agreements on other than constitutional or other 
legal grounds, the Attorney General, the head of department 
concerned, or the Director shall refer the matter to the NSC. 

3.3 Procedures . The activities herein authorized that 
require procedures shall be conducted in accordance with 
existing procedures or requirements established under Executive 
Order 12333. New procedures, as required by Executive 

Order 12333, as further amended, shall be established as 
expeditiously as possible. All new procedures promulgated 
pursuant to Executive Order 12333, as amended, shall be made 
available to the Select Committee on Intelligence of the Senate 
and the Permanent Select Committee on Intelligence of the House 
of Representatives. 

3.4 References and Transition. References to "Senior Officials 
of the Intelligence Community" or "SOICs" in executive orders or 
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other Presidential guidance, shall be -deemed references to the 
heads of elements in the Intelligence Community, unless the 
President otherwise directs; references in Intelligence 
Community or Intelligence Community element policies or 
guidance, shall be deemed to be references to the heads of 
elements of the Intelligence Community, unless the President or 
the Director otherwise directs. 

3.5 Definitions . For the purposes of this Order, the following 
terms shall have these meanings: 

(a) Counterintelligence means information gathered and 
activities conducted to identify, deceive, exploit, disrupt, or 
protect against espionage, other intelligence activities, 
sabotage, or assassinations conducted for or on behalf of 
foreign powers, organizations, or persons, or their agents, or 
international terrorist organizations or activities. 

(b) Cover t action means an activity or activities of the 
United States Government to influence political, economic, or 
military conditions abroad, where it is intended that the role 
of the United States Government will not be apparent or 
acknowledged publicly, but does not include: 

(1) Activities the primary purpose of which is to 
acquire intelligence, traditional counterintelligence 
activities, traditional activities to improve or maintain the 
operational security of United States Government programs, or 
administrative activities; 

(2) Traditional diplomatic or military activities or 
routine support to such activities; 

(3) Traditional law enforcement activities conducted 
by United States Government law enforcement agencies or routine 
support to such activities; or 

(4) Activities to provide routine support to the 
overt activities (other than activities described in 
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paragraph (1), (2), or (3)) of other United States Government 

agencies abroad. 

(c) Electronic surveillance means acquisition of a 
nonpublic communication by electronic means without the consent 
of a person who is a party to an electronic communication or, in 
the case of a nonelectronic communication, without the consent 
of a person who is visibly present at the place of 
communication, but not including the use of radio direction- 
finding equipment solely to determine the location of a 
transmitter . 

(d) Employee means a person employed by, assigned 

or detailed to, or acting for an element within the Intelligence 
Community. 


(e) Foreign intelligence means information relating to the 
capabilities, intentions, or activities of foreign governments 
or elements thereof, foreign organizations, foreign persons, or 
international terrorists. 

(f) Intelligence includes foreign intelligence and 
counterintelligence . 

(g) Intelligence activities means all activities that 
elements of the Intelligence Community are authorized to conduct 
pursuant to this order. 

(h) Intelligence Community and elements of the 
Intelligence Community refers to: 

(1) The Office of the Director of National 
Intelligence; 


(2) The Central Intelligence Agency; 

(3) The National Security Agency; 

(4) The Defense Intelligence Agency; 

(5) The National Geospatial-Intelligence Agency; 

(6) The National Reconnaissance Office; 

(7) The other offices within the Department 
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of Defense for the collection of specialized national foreign 
intelligence through reconnaissance programs; 

(8) The intelligence and counterintelligence 
elements of the Army, the Navy, the Air Force, and the Marine 
Corps; 

(9) The intelligence elements of the Federal Bureau 
of Investigation; 

(10) The Office of National Security Intelligence of 
the Drug Enforcement Administration; 

(11) The Office of 7 Intelligence and 
Counterintelligence of the Department of Energy; 

(12) The Bureau of Intelligence and Research of the 
Department of State; 

(13) The Office of Intelligence and Analysis of the 
Department of the Treasury; 

(14) The Office of Intelligence and Analysis of the 
Department of Homeland Security; 

(15) The intelligence and counterintelligence 
elements of the Coast Guard; and 

(16) Such other elements of any department or agency 
as may be designated by the President, or designated jointly by 
the Director and the head of the department or agency concerned, 
as an element of the Intelligence Community. 

(i) National Intelligence and Intelligence Related to 
National Security means all intelligence, regardless of the 
source from which derived and including information gathered 
within or outside the United States, that pertains, as 
determined consistent wirh any guidance issued by the President, 
or that is determined for the purpose of access to information 
by the Director in accordance with section 1.3(a) (1) of this 
order, to pertain to more than one United States Government 
agency; and that involves threats to the United States, its 
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people, property, or interests; the development, proliferation, 
or use of weapons of mass destruction; or any other matter 
bearing on United States national or homeland security. 

(j) The National Intelligence Program means all programs, 
projects, and activities of the Intelligence Community, as well 
as any other programs of the Intelligence Community designated 
jointly by the Director and the head of a United States 
department or agency or by the President. Such term does not 
include programs, projects, or activities of the military 
departments to acquire intelligence solely for the planning and 
conduct of tactical military operations by United States Armed 
Forces . 

(k) United States person means a United States citizen, an 
alien known by the intelligence element concerned to be a 
permanent resident alien, an unincorporated association 
substantially composed of United States citizens or permanent 
resident aliens, or a corporation incorporated in the 

United States, except for a corporation directed and controlled 
by a foreign government or governments. 

3 . 6- Revocation . Executive Orders 13354 and 13355 of August 27, 
2004, are revoked; and paragraphs 1.3(b) (9) and (10) of Part 1 
supersede provisions within Executive Order 12958, as amended, 
to the extent such provisions in Executive Order 12958, as 
amended, are inconsistent with this Order. 

3.7 General Provisions . 

(a) Consistent with section 1.3(c) of this order, nothing 
in this order shall be construed to impair or otherwise affect: 

(1) Authority granted by law to a department or 
agency, or the head thereof; or 

(2) Functions of the Director of the Office of 
Management and Budget relating to budget, 
administrative, or legislative proposals. 


39 

B-40 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 


Version Dated: 
October 15, 201 1 



UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 


(b) This order shall be implemented consistent with 
applicable law and subject to the availability of 
appropriations . 

(c) This order is intended only to improve the internal 
management of the executive branch and is not intended to, 
and does not, create any right or benefit, substantive or 
procedural, enforceable at law or in equity, by any party 
against the United States, its departments, agencies or 
entities, its officers, employees, or agents, or any other 
person. 


/s/ Ronald Reagan 


THE WHITE HOUSE 
December 4, 1981 
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APPENDIX C: (U//FOUO) USE AND TARGETING OF A FEDERAL 
PRISONER HELD IN THE CUSTODY OF THE BOP OR USMS 
DURING AN FBI PREDICATED INVESTIGATION; INTERVIEW OF A 
FEDERAL PRISONER HELD IN THE CUSTODY OF THE BOP OR 
USMS DURING AN FBI ASSESSMENT OR PREDICATED 
INVESTIGATION 

C.l (U) Overview/Summary 

(U//FOUO) Use and Targeting a Federal Prisoner: During an FBI Predicated Investigation, it 
may be necessary and appropriate to: 1) use a cooperating federal prisoner to gather and obtain 
evidence and intelligence; or 2) target a federal prisoner. This policy sets forth the approval 
process for the use of and targeting of a federal prisoner held in the custody of the Bureau of 
Prisons (BOP) or the United States Marshals Service (USMS). 

(U//FOUO) Interview a Federal Prisoner: During an FBI Assessment or Predicated 
Investigation, it may be necessary and appropriate to interview a federal prisoner in the custody 
of the BOP or USMS. This policy sets forth the approval process for the interview of a federal 
prisoner held in the custody of the BOP or the USMS during an FBI Assessment or Predicated 
Investigation. 

(U//FOUO) Exclusions from this Policy: This policy does not apply to: 

A) (U//FOUQ1 


C.2 (U) Legal Authority 

(U) The FBI is authorized by the Department of Justice (DOJ) to use and target a federal prisoner 
for investigative purposes and interview a Federal Prisoner (DOJ Memorandum “ Use and 
Targeting of Federal Prisoners in Investigations. ” January 22, 2009). 

C.3 (U) Definitions 

(U) Federal Prisoner: For purposes within this section, a federal prisoner is one who is held in 
the custody of either the BOP or the USMS pursuant to an order of a court in connection with a 
criminal matter, regardless of where the person is housed. 

(U) Use of a Federal Prisoner: Use of a federal prisoner means to employ a federal prisoner 
during an investigation in such a manner that the prisoner will interact with others who are not 
members of law enforcement (e.g., the prisoner will engage in a consensually monitored 
telephone call with a target) or the prisoner will be taken out of the custody of BOP or USMS 
(e.g., the prisoner is removed from the prison to assist the FBI in locating a hide-out) or law 
enforcement will interact covertly with the prisoner (e.g., an undercover agent engages with the 
prisoner in the visiting room of the prison). 
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(U) Targeting a Federal Prisoner: “Targeting” a federal prisoner means that the federal 
prisoner is the target of the investigation and that investigative activity will directly interact with 
either the prisoner or the federal facility (e.g., as part of a money laundering investigation 
targeting a prisoner, the FBI wishes to engage in a consensually monitored conversation with the 
prisoner). 

(U) Interview of a Federal Prisoner: Interview of a federal prisoner means to interact with a 
federal prisoner, overtly representing oneself as an FBI employee, in order to gather information. 

C.3.1 (U) Use and Targeting a Federal Prisoner 


(U//FOUO) An FBI employ ee may request the use of or the targeting of a federal prisoner in an 
FBI Predicated Investfeatiorl 



OJ//FOUOI 





C.3 .2 (U) Interview a Federal Prisoner 

(U//FOUO) An FBI emplo yee may request to interview a federal prisoner in an FBI Assessment 
or Predicated Investigation 


C.4 (U) Approval Requirements 



A) (U//FOUO) The FBI field office employee must: 
1) (U//FQUO) | 


2) (U//FOUO^ 
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(U//FOUO) Note : The DOJ Memorandum governing the Use and Targeting of Federal 
Prisoners is labeled “Sensitive Investigative Matter.” This is not a SIM as defined i n DIOG 
Section 10.1 ~ _ ~™ ~ I 


CA.2 (U) Approval - Interview a Federal Prisoner 

(U//FOUO) The FBI employee must: 


A) (U//FOUO; 
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C.6 (U) Extension Requests 


(U//FOUO) Agents may request extensions of the authority to use or target a prisoner in an FB I 
investigation | 


A) (U//FOUO)| 

B) (U//FOUO j 

C) (U//FOUQ 1 | 

D) ('U//FOUQ 1 I 

E) ('U//FOUO') ! ~l 

C.7 (U) Transportation of Federal Prisoner 


(U//FOUO) If it is necessary to remove the fe deral prisoner from the detention facility in which 
he/she is housed as a part of the investigation J I 


A ) (U//FOUO)[ 


B) (U//FOUO)[; 

C) (U//FOUO)[ 

D) (U//FOUO) [ 


E) (U//FOUO)! 

F) (y//FpUO)| 


G ) (U//FOUOf 


H) (U//FOUO)[ 
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APPENDIX D: (U) DEPARTMENT OF JUSTICE 
MEMORANDUM ON COMMUNICATIONS WITH THE WHITE 
HOUSE AND CONGRESS, DATED MAY 11, 2009 
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APPENDIX E: (U//FOUO) ATTORNEY GENERAL 
MEMORANDUM - REVISED POLICY ON THE USE OR 
DISCLOSURE OF FISA INFORMATION, DATED JANUARY 10, 
2008 
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U.S. Department of Justice 
National Security Division 


Office of the Assistant Attorney General 


Washington, D.C 20530 


January 10, 2008 


TO: All United States Attorneys 

All National Security Division Attorneys 
All Anti-Terrorism Coordinators 


CC: Assistant Attorney General, Criminal Division 

Assistant Attorney General, Civil Division 
Director, Federal Bureau of Investigation 

FROM: Kenneth L. Wainstein 

Assistant Attorney General for National Security 

SUBJECT: Revised FISA Use Policy as Approved bv the Attorney General 

We are pleased to provide the Department of Justice’s revised policy on the use or 
disclosure of information obtained or derived from collections under the Foreign Intelligence 
Surveillance Act of 1978 (FISA), as approved by the Attorney General today. Also attached is a 
form for use with respect to notifications that are required under Section I of the revised policy. 

This revised policy includes significant changes from current practice that will streamline 
the process for using FISA information in certain basic investigative processes, while still 
ensuring that important intelligence and law enforcement interests are protected. 

You will note that the revised policy authorizes the use or disclosure of FISA 
information, under the specific circumstances described in the policy, with notification to NSD 
and after consultation with the FBI (or other Intelligence Community agencies) for the following 
investigative processes: 
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As described in the revised policy, the Department continues to require prior 
authorization from the Assistant Attorney General for National Security (AAG/NSD) for the use 
or disclosure of FISA information in order to file criminal charges or in post-charge criminal 
proceedings, as well as in connection with certain investigative processes (e.g., criminal search 
warrants under Rule 41 of the Federal Rules of Criminal Procedure). The revised policy also 
requires the prior authorization of the AAG/NSD or his designee for the use or disclosure of 
FISA information in non-criminal proceedings. 

The revised policy was drafted by a Justice Department working group that included 
representatives from the Attorney General’s Advisory Committee of United States Attorneys 
(AGAC), National Security Division (NSD), Federal Bureau of Investigation (FBI), and Office of 
Legal Policy (OLP). The working group also consulted with the Office of the Director of 
National Intelligence (ODNI) in the course of the development of this policy. 

The revised policy requires that it be reviewed one year from its effective date and 
requires NSD to issue guidance on what constitutes information “derived from” FISA collections 
by March 31, 2008. 

As noted in the policy, prosecutors are encouraged to contact the National Security 
Division at any time in order to obtain guidance regarding this policy and to expedite resolution 
of any issues. 
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U.S. Department of Justice 



Office of the Attorney General 


Washington, D.C. 20530 


January 10, 2008 


TO: 

CC: 


FROM: 

SUBJECT: 


All Federal Prosecutors 

Assistant Attorney General, National Security Division 
Assistant Attorney General, Criminal Division 
Assistant Attorney General, Civil Division 
Director, Federal Bureau of Investigation 



Michael B. Mukasey^ 

Attorney General ^ l 

Revised Policy on the Use or Disclosure of FISA Information 


As a general matter, it is the policy of the Department of Justice to use all lawful 
processes in the investigation and prosecution of cases involving terrorism, intelligence, and 
national security, and to undertake all efforts necessary to protect the American people from the 
threat posed by foreign powers and their agents, while also exercising due regard for the 
protection of intelligence sources, methods, and collections, and the privacy and civil liberties of 
United States persons. 

There are important purposes to be served by consultation and coordination with respect 
to the use or disclosure of FISA information 1 in investigations, criminal prosecutions, and other 
proceedings. First, because FISA information is almost always classified, the use or disclosure 
of such information will normally require declassification by the originating agency in 
accordance with the originating agency’s policies and procedures. Second, the use of such 
information could directly or indirectly compromise intelligence sources, methods, or 
collections, or disclose the existence or nature of or otherwise compromise an investigation. 
Third, FISA requires the Government to notify the court and an “aggrieved person” of its intent 


1 The term “FISA information,” as used in this policy, means any information acquired, obtained, or derived from 
collection authorized pursuant to FISA. Whether specific information qualifies as “derived from” FISA collection 
may be a fact-bound question that depends, at least in part, on the attenuation of the information to be used from the 
original FISA acquired or obtained information and whether the information was also obtained from an independent 
source, as well as other factors. Where such a question arises, the application of this policy should be discussed 
among the USAO, FBI, and NSD, and if consensus is not reached, a determination will be made by the Assistant 
Attorney General for National Security. Separate guidance regarding what constitutes information “derived from” 
FISA collection will be issued by the National Security Division no later than March 3 1, 2008. 
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to use or disclose any FISA information before it is used against such person in a broad range of 
proceedings. Fourth, the Government is required to ensure that complete and accurate filings are 
made with the Foreign Intelligence Surveillance Court (FISC), and that the Government 
complies with all of FISA’s statutory requirements. Fifth, it is important to ensure that litigation 
risks, if any, are properly assessed. Finally, in certain cases, it may be appropriate to make 
disclosures to a United States District Court regarding classified facts before legal process is 
obtained. 

Given these purposes, it is essential that coordination take place in connection with the 
use or disclosure of FISA information. Such coordination should be streamlined in order to 
promote efficient, nimble, and useful investigative activities. The risk of compromising the 
purposes described above varies depending on the stage of the investigation, criminal 

prosecution, or other proceeding. As a general matted | b7E 

fe deral prosecutors should consider alternative 

approaches for taking action. 

Prosecutors are encouraged to contact the National Security Division at any time in order 
to obtain guidance regarding this policy and to expedite resolution of any issues. 

The following policy is therefore adopted and supersedes any existing Attorney General 
policies with respect to the use and disclosure of FISA information to the extent that they are 
inconsistent with this policy: 

(a) the Assistant Attorney General for National Security may act as the Attorney 
General, as provided for under FISA, see 50 U.S.C. § 1 801 (g), for the purpose of 
authorizing the use or disclosure of FISA information pursuant to this policy; 2 and 

(b) federal prosecutors and all others who may seek to me or disclose FISA 
information in any trial, hearing, or other proceeding in or before any court, 
department, officer, agency, regulatory body, or other authority of the United 
States, in coordination withNSD and FBI, are authorized to do so pursuant to th e 

terms of this policy, shall coordinate with NSDl I b7E 

l and shall comply with the 

following procedures in matters that involve the use or disclosure of FISA 
information: 3 


2 Such authorization may also be provided by the Attorney General, Acting Attorney General, and the Deputy 
Attorney General. See 50 U.S.C. § 1801(g). 

3 Nothing in this policy is intended to supersede or replace existing policies for prosecutors regarding notification, 
consultation, and approval for certain investigative and prosecutive steps, including consultation with other districts 
where related matters may be under investigation. For example, the United States Attorneys’ Manual sets forth 
when a prosecutor must obtain prior approval for various court actions in national security prosecutions. See, e.g., 
United States Attorneys’ Manual (USAM) §§ 9-2.13 1 (“Matters Assumed by Criminal Division or Higher 
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L Use or Disclosure of FISA Mormation Requiring Consultation with FBI or other 

Intelligence Community Agencies and Notification to NSD 

A. Certain investigative processes present only moderate risks. As a result, where 
FISA information is used or disclosed in connection with the processes described 
below, consultation with FBI (or other Intelligence Community agencies, as 
appropriate ) 4 and notice to NSD is required: 




B. Where FISA information is used or disclosed in connection with the processes 
described above, the following notification process shall be followed: 
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1 . 
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Authority”); 9-2,136 (Investigative and Prosecutive Policy for International Terrorism Matters”); 9-2.155 
(“Sensitive Matters"); 9-2.400 (“Prior Approvals Chart"). 

4 For the purposes of this document, the term “Intelligence Community agencies” refers to the appropriate agencies 
within the Intelligence Community, including the Office of the Director of National Intelligence. Consultation with 
Intelligence Community agencies other than the FBI is typically appropriate when the sources, methods, or 
collections involve Intelligence Community agencies other than the FBI. Prosecutors are encouraged to contact the 
National Security Division, as needed, to assist with the consultation process with the FBI or other Intelligence 
Community agencies. 

5 Some courts require a significant measure of information with respect tc | 

I | To the ex tent that applications in such districts require the disclosure of additional FISA information 

beyond the disclosure ol| - - --- 

| | advance authorization as provided for in Section II of this policy is required prior to such applications being 

made to the court. 
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2. As provided on the attached draft] 
. must indicate that he or she haT 


the federal prosecutor 

I 


above — to ensure that NSD complies with potential obligations to notify 
the Foreign Intelligence Surveillance Court. 


C. Where consultations with the FBI (or other Intelligence Community agencies, a s 
appropriate) demonstrate that I 

further consultation that includes NSD (working with Intelligence Community 
agencies, as appropriate) shall take place prior to the use of such processes. 


1 . 


D. This section does not permit the use or disclosure of FISA information obtained 

— Federal prosecutors must 

seek specific, separate use authority from the Assistant Attorney General for 
National Security prior to initiating any criminal proceedings. 

II. Use or Disclosure of FISA Information Requiring the Advance Authorizationofthe 
Assistant Attorney General for National Security 


A. The advance authorization of the Assi stant Attorney General for National Security 
is required where FISA information is 
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1 . 


Investigative Processes Requiring Advance Authorization 


a. 


| As 

a result, authorization ol the Assistant Attorney General for 
National Security is required before FISA information is used or 
disclosed in connection with the processes described below: 


b7E 
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11 . 

iii. 


iv. 


Title 18, Chapter 

119, United States Code; 


f itle 18, Chapter 121, United 

States Code; 

"[ Rule 41 of the Federal Rules of 

Criminal Procedure; 


b7E 

b7E 

b7E 
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V. 


vi. 

vii. 



2 . 


Criminal Indictments and Post-Indictment Proceedings 


a. 


The use or disclosure of flSA i rf om ra tto fl l 

I As a result the 

advance authorization of the Assistant Attorney General for 
National Security is required before such use or disclosure. 


b. This advance authorization requirement applies td I 
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4. Because the process of obtaining advance authorization will require NSD 
to coordinate with Intelligence Community agencies, federal prosecutors 
should seek such advance authorization at the earliest juncture possible. 
In addition, because the use of such information will normally require 


a. Prosecutors are encouraged to contact NSD at any time in order to 
obtain guidance regarding this policy and to expedite resolution of 
any issues. 


b. 


Where advance authorization involvingf 


JNSD shall provide 


notice of such request to ODNI. 


III. Use or Disclosure of FISA Information In Non-Criminal Proceedings 


(Therefore, authorization of the Assistant Attorney 

General for National Security or his designee is required before such use or 
disclosure. 


1 . 
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2. Among the fa ctors that will be considered with respect to granting use 
authority are: I 


3. Because the process of obtaining advance authorization will require NSD 
to coordinate with Intelligence Community agencies, the attorney for the 
government should seek such advance authorization at the earliest juncture 
possible. In addition, because the use of such information will normally 
requirel I 


b7E 


b7E 


a. Prosecutors are encouraged to contact NSD at any time in order to 
obtain guidance regarding this policy and to expedite resolution of 
any issues. 

b. Where advance authorization involving particularly sensitive 
sources, methods, or collections is requested, NSD shall provide 
notice of such request to ODNI. 

This policy shall be reviewed one year from its effective date to evaluate its 
effectiveness. 
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APPENDIX F: (U) USE OF FORCE POLICY 

F.l (U) Use of Less-than-Lethal Devices 

(U) Deputy Attorney General’s Memorandum on Use of Less-than-Lethal Devices dated 
4/21/2011. 

F.2 (U) Use of Deadly Force 

(U) Deadly Force Policy, dated 7/1/2004. 

F.3 (U) Training 

A) (U) Deadly Force Policy Training Material, dated 7/29/2004. 

B) (U) Instructional Outline and Use of Force Scenarios. 


F-1 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 


Version Dated: 
October 15, 2011 


ALL IMfOKMfeTIOQHf CGETTAINID 

HEREIN IS UNCLASSIFIED 

DATE 0J5-16-2014 BY NSI(^F64H92K24 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 


F. 1 (U) Use of Less-than-Lethal Devices 

(U) Deputy Attorney General’s Memorandum on Use of Less-than-Lethal Devices dated 
4 / 21 / 2011 . 
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F.2 (U) Use of Deadly Force 

(U) Deadly Force Policy, dated 7/1/2004. 
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POLICY STATEMENT USE OF DEADLY FORCE 

GENERAL PRINCIPLES 

I. Law enforcement officers and correctional officers of 

the Department of Justice may use deadly force only when 
necessary, that is, when the office has a reasonable 
belief that the subject of such force poses an imminent 
danger of death or serious physical injury to the 
officer or to another person. 

A. Deadly force may not be used solely to prevent 
the escape of a fleeing suspect. 

B. Firearms may not he fired solely to disable 
mov i ng veh i c 1 es . 

C. If feasible and if to do so would not increase the 
danger to the officer* or others, a verbal warning to 
submit to the authority of the officer shall be given 
prior to the use of deadly force. 

D. Warning shots are not permitted outside of the prison 
context . 

E. Officers will be trained in alternative methods and 
tactics for handling resisting subjects which must be 
used when the use of deadly force is not authorized 
by this policy. 

CUSTODIAL SITUATIONS 

II. Unless force other than deadly force appears to be 
sufficient, deadly force may be used to prevent the escape of 
a prisoner committed to the custody of the Attorney General 
or the Bureau of Prisons 

A. if the prisoner is effecting his or her escape in a 
manner that poses an imminent danger to the safety of the 
officer or another person; or 

B. if the prisoner is escaping from a secure facility or is 
escaping while in transit to or from a secure facility. 

III. If the subject is in a non-secure facility deadly force may 
be used only when the subject poses an imminent danger of 
death or serious physical injury to the officer or another 
person . 
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IV. If the subject is in transit to or from a non-secure 
facility and is not accompanied by a person who is in 
transit to or from a secure facility, deadly force may be 
used only when the subject poses an imminent danger of death 
or serious physical injury to the officer or to another 
person. 

V. After an escape from a facility or vehicle and its immediate 

environs has been effected, officers attempting to apprehend 
the escaped prisoner may use deadly force only when the 
escaped prisoner poses an imminent danger of death or serious 
physical injury to the officer or another person. 

VI. Deadly force may be used to maintain or restore control of a 
prison or correctional facility when the officer reasonably 
believes that the intended Subject of the deadly force is 
participating in a disturbance in a manner that threatens the 
safety of the officer or another person. 

VII. In the prison context, warning shots may be fired within or in 
the immediate environs of a secure facility if there is no 
apparent danger to innocent persons: (A) If reasonably 
necessary to deter or prevent the subject from escaping from a 
secure facility or (B) if reasonably necessary to deter or 
prevent the subject’s use of deadly force or force likely to 
cause serious physical injury. 


APPLICATION OF THE POLICY 

VIII. This Policy is not intended to, and does not, create any 
right or benefit, substantive or procedural, enforceable at law 
or in equity, against the United States, its departments, 
agencies, or other entities, its officers or employees, or any 
other person. 

♦♦ 
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F.3 (U) Training 

A) (U) Deadly Force Policy Training Material, dated 7/29/2004. 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 07/29/2004 

To: All Divisions Attn: AD 

ADIC 

SAC 

CDC 

PFI 

FBIHQ, Manuals Desk 
FBIHQ, Manuals Desk 


From: General Counsel 

Legal Ins truction Unit 

Contact: I 


Approved By : Caproni Valerie E 


Drafted By: 


Case ID # : 66F-HQ-1312253 
66F-HQ-C1384970 
66F-HQ-C1384970 

Title: REVISIONS TO THE DEPARTMENT OF 

JUSTICE DEADLY FORCE POLICY - 
DISSEMINATION OF TRAINING MATERIALS 

Synopsis: This Electronic Communication (EC) provides recipients 

with training materials incorporating the revisions approved on 
July 1, 2004 to the Department of Justice (DOJ) Deadly Force 
Policy. 

Reference: 66F-HQ-1312253 Serial 8 

Enclosure (s) : One copy of an instructional outline and one copy 

of use of force scenarios provided to all recipients for training 
purposes . 

Details: As discussed in the referenced EC, dated 7/7/2004, on 

July 1, 2004, the Attorney General approved a revised Policy 
Statement on the use of Deadly Force. In order to assist Field 
Offices in providing training and guidance on the practical 
application of the Deadly Force Policy in light of the revised 
language, the Legal Instruction Unit (LIU) , Office of the General 
Counsel, revised training materials used with the prior Policy 
Statement to reflect the changes approved by the Attorney 
General . 
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Re: 66F-HQ-1312253, 07/29/2004 


The training materials consist of an Instructional 
Outline and a set of 13 factual scenarios with a discussion of 
the use of force within the scenario and whether its use violates 
the policy. This material is similar to what was used for 
instructional purposes since 12/1/1995. The revised material 
reflects what was noted in the EC, that the revised policy does 
not expand or contract the current justification for the use of 
deadly force. Nonetheless, revisions to the training materials 
were necessary in order to describe the application of deadly 
force consistent with the new more succinct policy statement. 

The revisions to the training materials primarily 
relate to the elimination of the "safe alternative" language as a 
function of the "necessity" for us e of deadly force and 
elimination of language addressing I 

— — | For a more detailed 

discussion of the nature of the revised Policy Statement and the 
basis for these revisions, refer to the referenced EC. 
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To: All Divisions From: General Counsel 

Re: 66F-HQ-1312253, 07/29/2004 


LEAD ( s ) : 

Set Lead 1: (Action) 

ALL RECEIVING OFFICES 

It is requested that this communication be distributed 
to all appropriate personnel . 


♦♦ 
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DEADLY FORCE POLICY 
TRAINING MATERIAL - 7/29/2004 

DEPARTMENT OF JUSTICE DEADLY FORCE POLICY 1 


Law enforcement officers of the Department of Justice may use deadly force only 
when necessary, that is, when the officer has a reasonable belief that the subject of such 
force poses an imminent danger of death or serious physical injury to the officer or to 
another person. 

A. Deadly force may not be used solely to prevent the escape of a fleeing 
suspect. 

B. Firearms may not be fired solely to disable moving vehicles. 

C. If feasible and to do so would not increase the danger to the officer or 
others, a verbal warning to submit to the authority of the officer shall be 
given prior to the use of deadly force. 

D. Warning shots are not permitted 2 

E. Officers will be trained in alternative methods and tactics for handling 
resisting subjects which must be used when the use of deadly force is not 
authorized by this policy. 

This policy is not intended to, and does not, create any right or benefit, substantive 
or procedural, enforceable at law or in equity, against the United States, its departments, 
agencies, or other entities, its officers or employees, or any other person. 


'Department of Justice Policy Statement Use of Deadly Force (07/01/2004) in pertinent part (Language 
relating to Custodial Situations has been intentionally omitted pursuant to FBI policy. See, 66F-HQ-13 12253, EC 
from the Director's Office to All Divisions, titled "REVISIONS TO THE DEPARTMENT OF JUSTICE 
DEADLY FORCE POLICY", dated 07/07/2004). 


2 

Not included in the above description is the policy relating to the use of deadly force to prevent the escape 
of a prisoner committed to the custody of the Attorney General or the Bureau of Prisons. Because Agents will 
seldom find themselves in a position to apply the custodial aspect of the policy, the FBI will adhere to the policy 
decision set forth in the Airtel from the Director to All Field Offices, titled "Deadly Force Policy Matters," dated 
1/5/95, which states "A policy decision has been made that except in cases of prison unrest which would principally 
involve HRT and/or SWAT, FBI Agents should adhere to the policy and training principles governing the use of 
deadly force in non-custodial situations. 
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F.3 (U) Training 

B) (U) Instructional Outline and Use of Force Scenarios. 
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07/29/2004 


INSTRUCTIONAL OUTLINE 


I. INTRODUCTION 

The following general principles shall guide the interpretation and application of this 
policy: 

A. This policy shall not be construed to require Agents to assume 
unreasonable risks to themselves. 

B. The reasonableness of an Agent's decision to use deadly force must be 
viewed from the perspective of the Agent on the scene without the 
benefit of 20/20 hindsight. 

C. Allowance must be made for the fact that Agents are often forced to 
make split-second decisions in circumstances that are tense, uncertain, 
and rapidly evolving. 

II. . DEFINITIONS 

A. "DEADLY FORCE": Is force that is reasonably likely to cause death or 
serious physical injury. 

B. "REASONABLE BELIEF": Is synonymous with "Probable Cause". It is 
determined by a totality of the facts and circumstances known to Agents 
at the time, and the logical inferences that may be drawn from them. 

C. "NECESSARY": The necessity to use deadly force based on the 
existence of a reasonable belief that the person against whom 

such force is used poses an imminent danger of death or serious physical 
injury to the Agent or other persons. 

D. "IMMINENT DANGER": "Imminent" does not mean "immediate" or 
"instantaneous", but that an action is pending. Thus, a subject may pose 
an imminent danger even if he is not at that very moment pointing a 

weapon at the Agent. For example, imminent danger may exist if 
Agents have probable cause to believe any of the following: 
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1. The subject possess a weapon, or is attempting to gain access 
to a weapon, under circumstances indicating an intention to 
use it against the Agents or others; or, 

2. The subject is armed and running to gain the tactical 
advantage of cover; or, 

3. A subject with the capability of inflicting death or serious 
physical injury— or otherwise incapacitating agents— without a 
deadly weapon, is demonstrating an intention to do so; or, 

4. The subject is attempting to escape from the vicinity of a 
violent confrontation in which the suspect inflicted or 
attempted the infliction of death or serious physical injury. 

Ill APPLICATION OF DEADLY FORCE 

In assessing the necessity to use deadly force, the following practical considerations are 

relevant to its proper application: 

A. Inherent Limitation on Abilities to Assess the Threat and Respond. 

1. Limited Time (Action v. Reaction) - there will always be an interval of time 
between a subject's action and an Agent's ability to perceive that action, to 
assess its nature, and to formulate and initiate an appropriate response. 

The inherent disadvantage posed by the action/reaction factor places a 
significant constraint on the time frame within which Agents must perceive, 
assess and react to a threat. 

2. Limited Means (Wound Ballistics) - When the decision is made to use deadly 
force, Agents have no guaranteed means of instantaneously stopping the 
threat. The human body can sustain grievous - even ultimately fatal - injury 
and continue to function for a period of time (from several seconds to several 
minutes) depending on the location, number, and severity of the wounds. The 
lack of a reliable means of instantaneously stopping the threat, may extend the 
time that imminent danger can persist. This factor further constrains the time 
frame within which Agents must respond to a perceived threat. 

B. Achieving Intended Purpose. 


1 b?E 
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If the subject does not surrender, the only reliable means of achieving that 
goal is to cause physiological incapacitation of the subject(s) as quickly as 
possible. Attempts to do anything else - such as shooting to cause minor 
injury - are unrealistic and can risk exposing Agents or others to continued 
danger of death or serious physical injury. 


2 . 


b7E 


C. Consideration of Risk to Other Parties. 

Even when deadly force is permissible, Agents should assess whether its 
use creates a danger to third parties that outweighs the likely benefits of 
its use. 
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APPENDIX H: (U) PRE-TITLE III ELECTRONIC SURVEILLANCE 
(ELSUR) SEARCH POLICY 


H.l (U) SCOPE 


(U) 18 U.S.C. § 2518(1) (e) requires that each application for an order to intercept wire, oral, or 
electronic communications (hereinafter “Title III”) contain a statement describing all previous 
applications for Title III surveillance of the same persons, facilities, or places named in the 
current application. The below policy is designed to conform with this statutory requirement, 
clarify any past confusion, and address the effects on the previous search policy resulting from 
the recent elimination of the requirement for an agency Action Memorandum by the Office of 
Enforcement Operations (OEO). 


H.l .1 (U) Compliance With The Previous Application Provision 

(U) 18 U.S.C. § 2518(1) (e) requires that each application for an order to intercept wire, oral, or 
electronic communications (hereinafter “Title III”) contain a statement describing all previous 
applications for Title III surveillance of the same persons, facilities, or places named in the 
current application. Although a failure to comply with § 2518(1) (e) will not always result in 
suppression of evidence, deliberate noncompliance likely will. 


(U) To comply with this requirement, FBI search policy requires that a “s earch.” i.e., an 


\ / 1 V 1 / - 

automated indices search, of the FBTs[ 


system be conducted 


prior to filing a Title III affidavit and application with the court. To assist field offices in 
conducting appropriate searches, the following guidelines are provided. 


H.l.1.1 (U) When To Search 

A) (U) ELSUR SEARCHES : ELSUR searches for both sensitive and nonsensitive Title Ills, 
including all original, extension, and renewal applications 1 , must be conducted not more than 
45 calendar days prior to the date the application and affidavit are filed with the court. 

B) (U) Any of the persons, facilities, and/or places named in an extension or renewal application 
and affidavit which have been the subject of a previous search conducted not more than 45 
calendar days prior to the date the application and affidavit are filed with the court need not be 
searched again. 

(U) If an individual named by a partial name, nickname, street name, and/or code name in a 
previous application is subsequently identified by at least a first initial and a last name, a 
search must be conducted for the now-identified individual prior to seeking any new 
application naming that person. 


b7E 


1 This requirement also applies to what is sometimes referred to as a "spin-off' Title III which is actually a 
new application to begin surveillance at or of additional facilities arising from an existing investigation in 
which one or more Title Ills have already been authorized. As such "spin-off’ Title Ills are considered to be 
an "original" request, even though some or all of the named persons are also named in the prior Title III(sj. 
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H.l.1.2 (U) How To Search 

(U) Th d I must be searched for previously submitted Title III applications to intercept 

communications involving any of the persons, facilities, and/or places specified in the current 
Title III application. 

A) (U) PRIOR APPLICATIONS : Searches are required only for previously submitted 

applications. There is no obligation to search for prior interceptions. The ELSUR search will 
provide records of the persons, facilities, and/or places named in prior applications filed by the 
FBI and other federal law enforcement agencies named in the request. Any prior applications 
identified must be set forth in the affidavit in support of the new application._ 

H.l.1.2.1 (U) Persons 

(U) In submitting a pre-Title III search request, list the true names or best known names of 
individuals for whom there is probable cause to believe that: (1) they are involved in the 
specified criminal activity, or (21 their criminal communications are expected to be 
intercepted over the target facility or within the target premises. 2 These individuals are often 
identified in the application and affidavit as the “Target Subjects,” “Target Violators,” and/or 
“Target Interceptees.” 

A) (U) A minimum of a first initial and last name is required for an | | search. Biographical 

data such as date of birth, FBI Number, and/or Social Security Account Number, if known, 
must be included in the search request, even if not listed in the affidavit. Aliases, partial 
names, nicknames, street names, and/or code names may also be included as further 
identifying information on the FD-940. However, they will only be searched if they otherwise 
meet minimum ELSUR search requirements. For example, if an alias is a full name alias, it 
must be included and will be searched (i.e., John Smith a/k/a “William Johnson” or William 
Smith a/k/a “Liam Smith”). However, if the subject is identified as John Smith a/k/a “Big 
Buddy,” “Big Buddy” may be included as further identifying information, but will not be the 
subject of a separate ELSUR search. 

B) (U) Persons not fully identified by at least a first initial and a last name who are identified in 
the application and affidavit as “John Doe,” “Jane Doe,” or “FNU LNU” need not be the 
subject of a pre-Title III ELSUR search. For example, FNU LNU a/k/a “El Jefe” need not be 
included in an ELSUR search, or listed in the FD-940 search request. 

C) (U) A search of the l I must be conducted for the subscriber or service provider of the target 
facility only if the subscriber or service provider is believed to be involved in the specified 
criminal offense(s). 

D) (U) Any additional persons, facilities, and/or places mentioned in the affidavit, but not also 
specified in the application as a person, facility, and/or place for which authorization to 
intercept is being sought, need not be searched or listed in the FD-940 (Pre-Title III ELSUR 
Search Request). 


2 (U) All individuals lis ted in the application and affidavit as being involved in the specified criminal activity 
should be searched in □ not just those individuals who are expected to be intercepted (i.e., both "Target 
Subjects/Violators" and "Target Interceptees" must be searched if an application distinguishes between the 
two groups). 
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H.l.1.2.2 (U) Facility 

(U) List available numeric and/or alphanumeric values directly associated with the targeted 
device, equipment, or instrument over or from which the subjects are communicating (e.g., a 
telephone, pager, computer, etc.), and over or from which interceptions are being sought. 

Such values may include, but are not limited to, the telephone number of a land line phone, 
cell phone, or pager, Personal Identification Number (PIN), Cap Code, Electronic Serial 
Number (ESN), International Mobile Subscriber Identity (IMSI) Number, International 
Mobile Equipment Identifier (IMEI) Number, and/or Internet account information (including 
but not limited to screen name, online identity, ICQ number, and/or IP address). 

A) (U) Names of businesses, organizations, or agencies must be searched only if there is probable 
cause to believe the business, organization, or agency is culpable in the specified criminal 
offense(s). 

B) (U) Searches need not be conducted for telephone numbers or other facilities subscribed to, 
leased, or owned by the FBI for use in the investigation for which the ELSUR is being sought. 

C) (U) Any additional facilities mentioned in the affidavit, but not also specified in the 
application as a person, facility, and/or place for which authorization to intercept is being 
sought, need not be searched or listed in the FD-940 (Pre-Title III ELSUR Search Request). 
For example, telephone numbers identified as calling or being called by the Target Telephone, 
and set out in the pen register section of a Title III affidavit need not be the subject of a pre- 
Title III ELSUR search. 

H.l.1.2.3 (U) Places 

(U) List: (1) each address of a targeted landline phone or computer terminal which will be 
subject to the Title III order, and/or (2)1 I 


|Do not include addresses 

of subscribers or proprietors of mobile installations such as cell phones, pagers, vehicles, 
boats or planes, etc. 

H.2.1.2.4 (U) ADDITIONS 

(U) Persons, facilities, and/or places added to an application and affidavit during the course of 
the review process and after the initial pre-Title III search request must be searched prior to 
submitting the affidavit to the court. 3 


3 Occasionally, during the course of their review, DOJ's Office of Enforcement Operations, will suggest that an 
additional name be added as a "Target Subject" (or similar) in a Title III a pplica tion and affidavit prior to the 
grant of DOJ approval. If that name is added, it must be searched through | I priorto submitting the 
affidavit to the court 
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H.l.1.3 (U) Where To Search 

(U) A search of the FBI’ s i ~l must be conducted for each item named in the search request. 

DOJ policy requires a search of the Drug Enf orceme nt Administration (DEA) and 
Immigration and Customs Enforcement ('ICE) I ~l for all Title 21 predicate offenses. As a 
matte r of F BI policy , a DEA and ICE ELSUR search is automatically conducted by FBIHQ 
for al l l and l l investigative classifications, and any other application involving a Title 21 
offense. 

A) (U) The ) | of any other federal, state, or local law enforcement agency that is actively 
participating in a joint investigation (as opposed to mere task force participation) or as to 
which there is reason to believe may have previously sought to intercept wire, oral, or 
electronic communications involving any of the persons, facilities, and/or places specified in 
the instant application, should be searched. Where a search of state and/or local law 
enforcement ELSUR records is requested, the request should include a point of contact from 
the outside agency, if known. 

B) (U) If there is reason to believe that, any of the persons, facilities, and/or places specified in the 
current application have been the target of Title III electronic surveillance by another federal 
agency, that agency must be requested to conduct an ELSUR search of its records. 

H.l.1.4 (U) How To Initiate A Search Request 

(U) Form FD-940 (Pre -Title I II ELSUR Search Request) is used for requesting pre-Title III 
ELSUR searches of tht j | of the FBI and any other federal, state, or local law enforcement 
agency. The form is designed to assist personnel requesting a search by guiding them through 
the process. Use of the form will ensure search requirements are met. 

(U) If an emergency situation exists, as defined by 18 U.S.C. § 2518(7), an ELSUR search 
may be requested telephonically to the field office EOT. 

H.l.1.4.1 (U) Search Procedure 

(U) The EOT will conduct a search of th ^ | for records of “previous applications only” or 
“all records” as specified in the FD-940. Records retrieved as a result of the search will be 
furnished to the requesting Agent. If intercept records are requested for any or all of the 
persons, facilities, and/or places named in the FD-940, intercept records which relate to 
unclassified criminal matters will be provided in their entirety to the requesting Agent and 
documented in the appropriate case file location(s). 

(U) It is the responsibility of the requesting Agent to use reasonable efforts to determine 
whether the persons, facilities, and/or places identified in the search are the same persons, 
facilities, and/or places specified in the current application. If there is reason to believe they 
are, offices identified as having filed previous applications must be contacted and the EOT in 
that office must be asked to review the pertinent investigative file(s) to determine whether the 
persons, facilities, and/or places identified in the search are, in fact, the same as those 
specified in the current application. x 
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(U) It is not necessary to contact other offices regarding common names for which no special 
identifying data is available unless there is reason to believe there is a nexus between the 
current investigation and the investigation conducted by the other field offices. 

(U) Documentation confirming the conduct of all pre-Title III ELSUR searches must be 
serialized in the appropriate investigative file. 

H.l.1.5 (U) What To Say 

A) (U) NO PREVIOUS APPLICATIONS : Sample proposed affidavit language when no previous 
applications have been filed: 

1) (U) “Based upon a search of the records of the Federal Bureau of Investigation (and any 
other agency requested), no previous applications have been filed for an order authorizing 
the interception of wire, oral, or electronic communications involving any of the persons, 
facilities, and/or places specified herein for which authorization to intercept is being 
sought.” 

B) (U) PREVIOUS APPLICATIONS : 

1) (U) If there was a previous application, include all relevant information concerning such 
application in the affidavit in support of the current application. Identify the persons, 
facilities, and/or places named, the method(s) of interception sought, the date the order was 
granted or denied, the court that issued or denied the order, the name of the authorizing or 
denying judge (if known), and the relevance, if any, of the previous application to the 
current investigation. 

2) (U) Sample proposed affidavit language when previous applications have been filed: 

“John Doe was named in a previous application for an order authorizing the interception of 
wire and electronic communications. The order was signed on (date), by U.S. District 
Judge (name), of the District of (State), authorizing the interceptions for a period of thirty 
(30) days. An extension of the order was signed by Judge (name) on (date), authorizing the 
continued interception for an additional 30-day period.” (Include relevance, if any, of the 
previous applications to the current investigation). 

H.l.1.6 (U) Documentation 

A) (U) Agents must provide a copy of the following to the field office’s ELSUR Operations 
Technician (EOT): 

1) (U) executed application, order and supporting affidavit; 

2) (U) completed CDC Checklist (FD-926); 

3) (U) EC signed by the appropriate approving official (SAC or designee or appropriate HQ 
official) documenting approval to seek court authorization for the Title III application; and 

4) (U) DOJ Memorandum directed to the AUSA entitled “Authorization for Interception 
Order Application.” 

B) (U) The EOT and the ELSUR supervisor are responsible for confirming that ELSUR searches 
were properly conducted as set forth in the final applications submitted to the court. Because 
this review is not conducted until after the application and order have been submitted to the 
court, the SA and SSA are responsible for verifying that all required ELSUR searches have 
been conducted prior to submission of the application and affidavit to the court. Within 10 
calendar days of obtaining court authority for the original and all extensions/renewals of the 
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Title III intercept, the case agent must also submit to the EOT a signed copy of the: (i) 
affidavit, (ii) application, (iii) order, (iv) SAC approval EC; (v) the DOJ authorizing Memo; 
and (vi) copy of the CDC Title III Checklist (FD-926). The EOT will be responsible for 
transmitting a copy of these documents to the Order Management Group in OTD. The Order 
Management Group will be respon sible for indexing and uploading these documents into the 
I ~l These requirements also apply to the joint Title III 

operations discussed in section 18.7.2.13. 


C) (U) Form FD-940 (Pre Title III ELSUR Search Request) mus t be used when requesting a 


|f any federal, state, or local law enforcement agency ’q 
ncluding the FBI’s. 


D) (U) All requests for ELSUR searches must be serialized in the corresponding investigative file 
and submitted with adequate time for the EOT to conduct the search and document the results. 
It is the responsibility of the affiant and the affiant’s supervisor to ensure that all ELSUR 
checks have been properly completed prior to submission of the application and affidavit to 
the court. 


H.l.1.7 (U) ADDITIONAL GUIDANCE AND EXAMPLES 

(U) Additional guidance regarding the conduct of pre-Title III ELSUR searches, including 
examples applying the policy set forth above, can be found at the DIOG Resources site 
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APPENDIX I: (U) ACCESSING STUDENT RECORDS MAINTAINED 
BY AN EDUCATIONAL INSTITUTION (“BUCKLEY AMENDMENT”) 

1.1 (U) Summary 

(U) The Family Educational Rights and Privacy Act (FERPA) of 1974 (20 U.S.C. § 1232g, as 
amended by Public Law 107-56 (USA Patriot Act)), commonly referred to as the “Buckley 
Amendment,” restricts the ability of educational agencies or institutions (collectively “schools”) 
to release educational records or personally identifiable information contained in such records 
without the consent of the student or the student’s parent. 

(U) FERPA defines “education records” as those records, files, documents and other materials 
which: 


A) (U) contain information directly related to a student; and 

B) (U) are maintained by an educational agency or institution or by a person acting for such 
agency or institution. (20 U.S.C. § 1232g(a)(4)(A)(i)). 

(U//FOUO) If operatiopally feasible, FBI employees should request the consent of the student or 
parent, as appropriate, in order to obtain covered records. During an Assessment, the FBI may 
ask school officials to provide certain information without the consent of the student or parent 
(see Section 18.5.6); during a Predicated Investigation, the FBI may compel production of 
education records, as set forth below. 

1.2 (U//FOUO) Accessing Student Information or Records During an 
Assessment 

(U//FOUO) During an Assessment, FBI employees may seek voluntary disclosure of certain 
student records and information about students from schools without the consent of the student 
or parent. 

1.2.1 (U) Directory Information 

(U//FOUO) “Directory information” is information contained in an education record of a student 
“that would not generally be considered harmful or an invasion of privacy.” (34 C.F.R. § 99.3) 
Specifically, “directory information” includes, but is not limited to: the student’s name, address, 
telephone listing, electronic mail address, photograph, date and place of birth, major field of 
study, dates of attendance, grade level, enrollment status (e.g., undergraduate or graduate, full- 
time or part-time), participation in officially recognized activities or sports, weight and height of 
members of athletic teams, degrees, honors and awards received, and the most recent educational 
agency or institution attended. A school may disclose “directory information” from its records 
without prior consent if: (1) it has a directory information policy to disclose such information 
and (2) it has provided its students notice of the policy and the opportunity to opt out of having 
“directory information” disclosed. (See 34 C.F.R. § 99.37) 
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(U//FOUO) The scope of information that can be released as directory information may be 
narrowed by the school. For instance, if a college chooses not to categorize students' names and 
addresses as directory information, it must not voluntarily disclose such information to the FBI 
( Krauss v. Nassau Community College, 469 N.Y.S. 2d 553 (N.Y. Sup. 1983)). Schools are also 
required to afford students (or parents, if the student is under 18) the opportunity to prohibit the 
release of directory information without their prior consent (or a court order). Note : the Buckley 
Amendment permits schools to release directory information (absent an objection from the 
student); it does not require them to do so. Directory information may be sought orally or in 
writing. 


1.2. 2 (U) Observations 

(U//FOUO) FERPA governs the release of educational records. It does not govern the release of 
information gathered by a school official, based on his or her own observations. Accordingly, 
notwithstanding Buckley, a school official may disclose activity or behavior observed by the 
official. 


1.2.3 (U) Law Enforcement Unit Records 

(U//FOUO) Under FERPA, schools may disclose information from “law enforcement unit 
records” without the consent of the parent or student. This exemption is limited to records that a 
law enforcement unit of a school creates and maintains for a law enforcement purpose. “Law 
enforcement record” is narrowly defined as a record that is: (i) created by the law enforcement 
unit; (ii) created for a law enforcement purpose; and (iii) maintained by the law enforcement 
unit. (34 C.F.R. § 99.8(b)) If another component of the school discloses a student education 
record to the school’s law enforcement unit, that record is not a “law enforcement unit record” 
because it was not created by the law enforcement unit. Thus, a law enforcement unit cannot 
disclose, without student consent, information obtained from education records created by other 
component of the school, even if the record has been shared with the law enforcement unit. 

1.2.4 (U) Health or Safety Emergency 

(U//FOUO) FERPA does not restrict the disclosure of educational records in connection with a 
health or safety emergency. The regulations provide that schools may disclose information from 
an education record “to appropriate parties in connection with an emergency if knowledge of the 
information is necessary to protect the health or safety of the student or other individuals” and 
that the exception is to be “strictly construed.” As is the case with other emergency disclosure 
provisions (see 18 U.S.C. § 2702), it is up to the school to determine in the first instance whether 
disclosure is necessary to protect the health or safety of the student or another individual. If it 
makes that determination, it is permitted to disclose educational records voluntarily and without 
the consent of the student or parent. 

1.2.5 (U) Non-Students 

(U//FOUO) FERPA governs records of “students.” A “student” is defined as a person on whom a 
school maintains educational records or personally identifiable information but does not include 
someone who has not attended that school. Files retained on rejected applicants may be provided 
without prior permission or notification. ( Tarka v. Franklin, 891 F.2d 102 (5 th Cir. 1989)) 
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1.3 (U//FOUO) Accessing Student Information or Records in Predicated 
Investigations 

(U//FOUO) In addition to seeking voluntary production of records that can be voluntarily 
produced (see 1.2 above), in a Predicated Investigation, FBI employees may compel production 
of education records without notice to the student or the student’s parents as follows: 

1.3.1 (U) Federal Grand Jury Subpoena 

(U//FOUO) Schools shall disclose education records in response to a federal grand jury 
subpoena. In addition, the court may order the institution not to disclose to anyone the existence 
or contents of the subpoena or the institution’s response. If the court so orders, then neither the 
prior notification requirements of 34 C.F.R. § 99.3 1(a)(9) nor the recordation requirements at 34 
C.F.R. § 99.32 would apply (see DIOG Section 18.6.5). 

1.3.2 (U) Administra tive Subpoenas 

(U//FOUO) Schools may disclose education records in response to an administrative subpoena. 
Administrative subpoenas may be issued in narcotics investigations (see DIOG Section 

18.6.4.3.2.1) , sexual exploitation or abuse of children investigations (see DIOG Section 

18.6.4.3.2.2) , and health care fraud investigations (see DIOG Section 18.6.4.3.2.3). As with 
federal grand jury subpoenas, the issuing agency may, for good cause shown, direct the school 
not to disclose the existence or contents of the subpoena or the institution’s response. If the 
subpoena includes a nondisclosure directive, the school is permitted to request a copy of the 
good cause determination. 

1.3.3 (U) FISA Order for Business Records 

(U//FOUO) See DIOG Section 18.6.7. 

1.3.4 (U) Ex Parte Orders 

(U//FOUO) The USA Patriot Act amended FERPA to permit schools to disclose personally 
identifiable information from the student’s education records to the Attorney General or his 
designee without the consent or knowledge of the student or parent in response to an ex parte 
order issued in connection with a terrorism investigation. Such disclosures are also exempt from 
the Buckley Act requirements that disclosure of information from a student’s records be 
documented in the student’s file. 


1-3 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 


Version Dared; 
October 15, 20U 


ALL IMfORMATION CXarTAINED 

HEBE IN IS UNCLASSIFIED 

DATE 04-10-2014 BY N5ICG/F64H32K24 


UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 

APPENDIX J: (U) INVESTIGATIVE FILE MANAGEMENT AND 
INDEXING 

J.l (U) Investigative File Management 

J.1.1 (U) Office of Origin (00) 

(U//FOUO) Generally, the Office of Origin (00) is determined by: 

A) (U//FOUO) The residence, location or destination of the subject of the investigation; 

B) (U//FOUO) The office in which a complaint is first received; 

C) (U//FOUO) The office designated by FBIHQ as 00 in any investigation; 

D) (U//FOUO) The office in which the Foreign Police Cooperation investigation is opened ( 1 63 
classification); 

E) (U//FOUO) The office in which the Domestic Police Cooperation investigation is opened (343 
classification); 

F) (U//FOUO) The office in which the recovery of the vehicle occurred in an Interstate 
Transportation of Stolen Motor Vehicles (ITSMV) investigations; 

G) (U//FOUO) The office in which the contempt of court occurred; 

H) (U//FOUO) The office in which there is a violation of an order, judgment, or decree issued 
from any judicial district in an FBI civil Racketeer Influenced and Corrupt Organizations 
(RICO) investigation; 

I) (U//FOUO) The office in which the subject was convicted in investigations involving parole, 
probation, and mandatory release violators; 

J) (U//FOUO) The office in which the escape occurred, in Escaped Federal Prisoner and escaped 
deserter investigations; 

K) (U//FOUO) The New York Field Office in courier investigations; 

L) (U//FOUO) FBIHQ in all applicant, Background Investigation - Pardon Attorney's Office (73 
classification) investigations; 

M) (U//FOUO) FBIHQ in OPM security referral (140A and 140C classification) investigations; 

N) (U//FOUO) FBIHQ, Counterterrorism Division (CTD), Counterterrorism Watch Unit in all 
Counterterrorism Major Cases (900 classification); 

O) (U//FOUO) FBIHQ, Critical Incident Response Group (CIRG) in all National Center for the 
Analysis of Violent Crime (NCAVC) cases (252A through 252E classifications); and 

P) (U//FOUO) FBIHQ, Office of Professional Responsibility (OPR) in OPR investigations (263 
classification). 

(U//FOUO) When special circumstances exist, however, the origin may be assumed by the field 

office which has the most compelling interest. Uncertainties and disagreements must be resolved 

by the appropriate FBIHQ operational division. 
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J.1.2 (U) Investigative Leads and Lead Office (LO) 

(U//FOUO) Leads are sent by EC, or a Lead Request document, to offices and assigned to 
individuals/organizations in order to aid investigations. When the 00 sets a lead to another 
office, that office is considered a Lead Office (LO). 

(U//FOUO) There are only two types of investigative leads: “Action Required” and “Information 
Only.” 

J.l.2.1 (U) Action Required Lead 

(U//FOUO) An action required lead must be used if the sending office requires the receiving 
LO to take some type of investigative action. 

(U//FOUO) An action required lead may only be set by EC out of an open investigative file, 
including an: 

A) (U) Assessment file, including a zero sub-assessment file; 

B) (U) Predicated Investigation file; 

C) (U) pending inactive investigation file; or 

D) (U) unaddressed work file. 

(U//FOUO) An action required lead cannot be set out of a closed investigative file, a zero (0) 
or double zero (00) file. 

(U//FOUO) An action required lead must be assigned, and it must be covered before the 
underlying investigation has been completed/closed. 

J.1.2. 2 (U) Information Only Lead 

(U//FOUO) An information only lead must be used when no specific action is required or 
necessary from the receiving LO. 

(U//FOUO) An information only lead may be set by EC out of an opened or closed 
investigative file, including a: 

A) (U) zero (0) file; 

B) (U) double zero (00) file; 

C) (U) Assessment file, including a zero sub-assessment file; 

D) (U) Predicated Investigation file; 

E) (U) pending inactive investigation file; or 

F) (U) unaddressed work file. 

(U//FOUO) An information only lead does not have to be assigned in order to be covered, and 
they can be covered while they are in the "Set" status. 
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J.1.3 (U) Office of Origin's Supervision of Cases 

(U//FOUO) The 00 is responsible for proper supervision of Assessments and investigations in 
its own territory and being conducted in a LO. The FBI employee, usually an FBI Special Agent, 
to whom an investigation is assigned, is often referred to as the “Case Agent.” An FBI employee 
is personally responsible for ensuring all logical investigation is initiated without u ndue dela y, 
whether the employee is assign ed in the 00 or in an LO; this includes setting forth l ~~| 

[ leads as appropriate for other offices or other FBI employees in 
his/her own office. The 00 Case Agent has overall responsibility for supervision of the 
investigation. When an LO has a delayed or delinquent investigation, it is the responsibility of 
the 00 Case Agent to notify the LO (orally or in writing by email or EC, depending on the 
urgency of the situation) of its delinquency. 

J.1.4 (U) Investigation and Other Files 

(U//FOUO) There are several types of non-investigative files used in the FBI, including zero 
files, double zero files, administrative files, and cont rol files. Additionally, there are several 
types of investigative files used in the FBI, including f [ Preliminary 

Investigation files, Full Investigation files, Full Enterprise Investigation files, positive foreign 
intelligence Full Investigation files, and unaddressed work files. Additionally, investigative files 
may have sub-files, named as specified in the DIOG and RMD policy. FBI files may be opened, 
closed, or placed in pending inactive status as specified below. Note that in each of these files, all 
communications related to previous communication must note the existing communication’s 
FBI’s central recordkeeping system serial numbers in the reference fields. 

(U//FOUO) Certain records may be restricted based on the classification of the records, e.g., on 
the sensitivity of the investigation. See the Corporate Policy Directive 243D. dated October 13, 
2009. 

(U//FOUO) The types of files are: 


J.l.4.1 (U)| | 

('U//FOUOII I 


J.l.4.2 (U) Double Zero "00" Files 

(U//FOUO) Double Zero files may be opened in all file classifications. Double Zero files may 
contain documentation, such as instructions, policy, statutes, and decisions applicable to the 
classification, that do not require investigation. The documents contained within a double z ero 
file must be serialized!"”" 
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b7E 


J.l.4.3 (U) Administrative "A" Files 

(U//FOUO) Administrative files may be used only for administrative purposes; they may not 
be used for investigative purposes. Administrative files may be used for documenting non- 
investigative matters, such as training matters (1 classification), administrative matters (319 
classification), personnel files (67 classification), etc. Note: Investigative activity may not 
be documented in an administrative file. Administrative files are designated with the letter 
"A" before the case number, e.g., 319X-HQ-A12345. 

(U//FOUO) Administrative (non-investigative) Leads may be assigned out of administrative 
files. When referring to the file number of an administrative file in communications, the file 
number must include the letter "A" as part of the case number to indicate the file is an 
administrative file. 

J.l.4.4 (U) Control “C" Files 

(U//FOUO) Control files are separate files established for the purpose of administering 
investigative programs. Control files are opened at the discretion of the individual responsible 
the investigative program. Control files may be opened in all classifications. 

(U//FOUO) Like administrative files, control files may be used only for administrative 
purposes. Control files may be used for documenting program management communications, 
policy pronouncements, technical or expert assistance to another law enforcement or 
intelligence agency, or other administrative/managerial functions. Administrative/managerial 
functions could include liaison contacts, training exercises, training received/provided, etc. 
Note: Investigative activity may not be documented in a control file. Administrative (non- 
investigative) leads can be assigned out of control files. 

(U//FOUO) Control files are designated with the letter “C” before the case number, e.g., 29B- 
NF-C4456. When referring to the file number of a control file in communications, the file 
number must include the letter "C" as part of the case number to indicate the file is a control 
file. 

J.l.4.5 (U) Investigative Files 

J.l.4.5.1 (U) Assessment Files 

J.l.4.5.1.1 (U j 


(U//FOUO)| 

I Ifypel & 

2 Assessments! 

[ Yhen completing the FD-71, Guardian or Assessment file 
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lead for an Assessment involving a sensitive inves] 

igative matter 





(U//FOUO) 


Jean be set when using a[ 


(U//FOUO) Until it is modified to accommodate al file classifications, Guardian may be 


uacu U111V IU1 UUklim 

regarding 

filmic UIOM; M^SCMMIICIILN UCMHTUGU HI LJIVJVT OCULIUll D.U.O.l 


Once the Guardian system is modified to accommodate all 


file classifications, it must be utilized to document) 
FD-71 must no longer be used to l 


(U//FOUO) Guardian, the FD-71, the EC and Lead Request form provide the ability to 
set action leads. 


J.l.4.5.1.2 (U) Investigative Classification Assessment Files (for Type 3, 4 

and 6 Assessments) and Potential CHS Files (for type 5 
Assessments) 


(U//FOUO) See DIOG Section 5 for the appropriate investigative file classification to be 
used when opening a Type 3, 4, 5, or 6 Assessment file. 

(U//FOUO) Because these Assessments require prior supervisory approval, the file must 
begin with an opening EC (DIOG Sect ion 5.6.3 .2 through 5.6.3.5 type Assessments a nd 
DIOG Section 5.7 as discussed above!. I 


J.l.4.5.2 (U) Preliminary and Full Investigation (Predicated) Files 


(U//FOUO) A Preliminary Investigation, Full Investigation, Full Enterprise Investigation, and 
Full Positive Foreign Intelligence Investigation must be opened as discussed in DIOG 
Sections 6, 7, 8, and 9, respectively. Investigative information related to these investigations 
must be placed in the investigative main file or sub-file, spun-off, or referred to another 
agency as authorized. 

J.l.4.5.3 (U) Pending/Inactive Full Investigation Files 

(U//FOUO) A Full Investigation may be placed in a pending-inactive status when all 
investigation has been completed and only prosecutive action or other dispos ition remains to 
be determined and reported, e.g., locating a fugitive outside the United States] 
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pending- 


inactive Full Investigation may be assigned to investigative personnel or a squad/unit. 


J.l.4.5.4 (U) Unaddressed Work Files 



(U//FOUO) The FD-71 and an Assessment file provide a mechanism to assign an Assessment 
to an Unaddressed Work file. In the FD-71, the Supervisor must select a reason for assigning 
the matter to the Unaddressed Work file and choose the appropriate classification. Upon 
serializing the FD-71, a new Unaddressed Work file will be opened. Guardian (FD-71 a) does 
not have an “Unaddressed Work” option because Guardian leads cannot be placed in an 
Unaddressed Work status. 


J.l.4.5.5 (U) Spin Off Investigation Files 


(U//FOUO) A spin-off investigation originates from an existing investigation. The spin-off 
investigation must have all the elements required to establish it as a separate investigation 
within the appropriate investigative classification. 
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J.1.5 (U) Sub-Files 

(U) The below standardized sub-file names must be used when creating sub-files to document 
the investigative or administrative activity described. However, other sub-file names may be 
utilized to document relevant investigative or administrative activities not specifically 
addressed by the following standardized sub-file list: 


SUB-FILES 

Sub-file Name 

DIOG Required 

RJVID and Other Policy 

ADMIN 

— 

Administrative Matters 

AFF 

... 

Affidavits 

ANA 


Analytical {not including Written Intelligence 
Products -see DIOG required INTELPRODS sub* 
file below} 

BC 

— 

Background Information Re Subject {FD-160; FD- 
125; FD-809) 

BIO 


Biographical Info (NCIC; CLETS; DMV) 

CART 

-- 

Computer Analysis Response Team 

CRIM 

— 

Criminal Records 

CCTV 

— 

Closed Circuit Television/Video Surveillance 

CE 

— 

Case Expenditures 

CD 


Classified Documents / Info 

CRT 

— 

Court Orders 





— 


~ 


— 

— 

— 

— 

— 

EMAIL 

— 

E-Mail 

FA 

— 

Financial Analysis 

FF 

— 

Forfeiture 


— 

— 


FISUR 

— 

Physical Surveillance Logs 

FTP 

-- 

Federal Taxpayer Information 

FUG 

— 

Fugitives 

GJ 

Federal Grand Jury Subpoenas and Materials 

— 

INTEL 

— 

Intelligence 

INTELPRODS 

Written Intelligence Products 

— 

LAB 

— 

Laboratory / Latent Reports 

LEADS 

— 

Leads 

LEGAL 

... 

Legal Documents 

LIAISON 

— 

Liaison and FD-999s 

LOC 


Locations 

MC 

— 

Mail Covers (Criminal and National Security) 
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MEDIA 

... 

Media Reports 

MISC 

— 

Miscellaneous 

NC 

... 


Newspaper Clippings and Press Releases 




— 

— 


... 

— 

PEN 

Pen Register / Trap And Trace 

— 

PH 

— 

Photographs (paper copies only) 

PR 


Police Reports 

RECORDS 


Bank / Tax / Financial Records 

REPORTS 

— 

Reports 

S 

— 

Suspects /Subjects 

SBP 

Administrative Subpoenas 

— 

SURV 

... 

Surveillance 

sw 

— 

Search Warrants (Criminal) 

T3 

— 

Consensual Monitoring Calls / Title III 

TC 

— 

Trash Covers 

TEL 

— 

Telephone Subscriber /Toll Information / Trap & 
Trace Calls 

TERRF1N 


Terrorist Financing-Related Information 

TS 

— 

Top Secret Documents 

TRANS 

— 

Transcripts 

TVL 1 

— 

Travel 

uco 

— 

Undercover Operations (Group 1 and Group II 
UCOs) 

vou 

— 

Vouchers 

1A 

— 

1A Exhibit 

IB 

— 

Evidence Chain of Custody (FD-192s or successor 
form) 

1C 

— 

Bulky, Non-Evidence (FD-192s or successor form) 

ID 

— 

ELSUR 

FD302 

... 

FD-302s (and other testimonial documents) 

FD515 

— 

Accomplishments (FD-515s or successor 
documents) 

FD542 

— 

Accomplishments (FD-542s or successor 
documents) 


(U) When more than one sub-file is needed for a specific category, sequential numbers are to 
be used adjacent to the described sub-file name. For example, three forfeiture sub-files would 
be named: FF1, FF2, FF3, etc. 


J.2 (U) Indexing - The Role of Indexing in the Management of FBI 

Information 

(U//FOUO) The text of FBI-generated records (including but not limited to FD-65, FD-786, and 
non-transitory electronic mail (e-mail) records) must be imported into the FBI’s central 
recordkeeping system to be searchable, retrievable, and sharable through automated means. A 
full text search of the FBI’s central recordkeeping system identifies only information that is 
available electronically and does not search for information that may be contained in the FBI’s 
paper records. Regardless of whether a record is imported or created in the FBI’s central 
recordkeeping system, it must be indexed. 

(U//FOUO) The purpose of indexing is to record individual’s names; non-individual’s names, 
such as corporations; and property which are relevant to FBI investigations so that this 


Version Dated: 
October 16 2013 


J-8 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 



UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 

information can be retrieved, if necessary. The most common use of indexed information is to 
respond to executive branch agencies’ request name searches as part of their investigations to 
determine suitability for employment, trustworthiness for access to classified information and 
eligibility for certain government benefits. If employees do not properly index names and places 
that arise in FBI investigations, the FBI could provide erroneous information to other federal 
agencies. Further advice about how to index and what should be indexed can be found on the 
RMD webpage . 
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APPENDIX K: (U) REPORTING OF SUSPECTED CHILD ABUSE, 
NEGLECT AND/OR SEXUAL EXPLOITATION 

K. 1 (U) Reporting of Suspected Child Abuse, Neglect and/or Sexual 

Exploitation 

K.1.1 (U) Purpose 

(U) In October 201 1, the Department of Justice (DOJ) released the updated 2011 Attorney 
General Guidelines for Victim and Witness Assistance (the “ Guidelines ”); and in May 2012, 
released revised Guidelines. Among other obligations, the Guidelines require DOJ personnel, 
including FBI personnel, to report suspected child abuse. Special Agents (SAs) and other FBI 
personnel may encounter suspected child abuse, neglect and/or sexual exploitation during the 
course of their duties. This policy provides the most recent DOJ/FBI suspected child abuse 
reporting requirements. “This requirement is in addition to, not in place of, mandatory reporting 
requirements under state, tribal and federal law with which [FBI Personnel] shall also comply” 
[Emphasis added]. Guidelines at Art. Ill, L.l.c (1). 

K.1.2 (U) Obligation to Report 

(U) The FBI’s role as a law enforcement agency necessitates several reporting requirements for 
FBI personnel who have reasonable cause to believe a child is suffering from abuse, neglect 
and/or sexual exploitation. 

(U) While certain FBI employees (e.g. law enforcement personnel and social workers) are 
defined as mandated reporters under state, tribal and federal law, all FBI employees shall report 
suspected child abuse, neglect and/or sexual exploitation to the state, local or tribal law 
enforcement agency or child protective services agency that has jurisdiction to investigate such 
reports or to protect the child. 

K.1.3 (U) Reporting to the Appropriate Officials 

(U) In every case of suspected child abuse, neglect and/or sexual exploitation, an immediate 
report shall be made to the appropriate state, local or tribal agency with authority to investigate 
such matters or to protect the child. FBI personnel should consult with the Chief Division 
Counsel (CDC) or the Office of the General Counsel (OGC) to determine the child abuse 
reporting laws applicable in their area of responsibility. 

(U) Reporting is generally covered by state, local or tribal law and reports shall be made to the 
agency or entity identified in and in accordance with those laws. However, the report of 
suspected child abuse should be made by a method best suited to giving immediate notice. Use 
of a standardized form is encouraged, but shall not take the place of the immediate making of 
reports by other means when circumstances dictate. 

(U) Reports may be made anonymously, although FBI personnel are strongly encouraged to 
provide sufficient identifying information. Reports are presumed to have been made in good faith 
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and reports are immune from civil and criminal liability arising from the report, unless acting in 
bad faith. 

(U) FBI personnel shall also immediately report suspected child abuse to the FBI’s Designated 
Official in each office. The Designated Official will assist FBI personnel with reporting 
suspected child abuse, if no direct report is made, and will ensure completion of a 188D- 
Electronic Communication (188D-EC) to the FBI’s Office of Victim Assistance (OVA). 

(U) In rare circumstances, reporting may be temporarily delayed upon a determination by an FBI 
Component Responsible Official. Per the Guidelines and FBI implementing policy, the 
designated FBI Component Responsible Official is the head of the division or office. For Field 
Divisions the Component Responsible Official is the Special Agent-iri-Charge (SAC), or where 
applicable, the Assistant Director in Charge (ADIC). For FBI Headquarters, the Component 
Responsible Official is the head of the Division or office (e.g.. Assistant Director (AD) or 
equivalent). 


K.1.4 (U) Scope of Reporting 

(U) All cases of suspected child abuse must be reported. A report shall be made even if the 
information inadvertently comes to the attention of FBI personnel. In cases where there is reason 
to believe an incident was previously reported or is otherwise being investigated, FBI personnel 
shall err on the side of caution, and consult with the Designated Official, due to the possibility of 
there being multiple offenses, victims, and/or perpetrators. If there are any distinguishable 
elements (e.g. different day, time, or place) from the confirmed previous report and investigation, 
FBI personnel shall immediately report the new case and any additional information to the state, 
local or tribal law enforcement agency or child protective services agency that has jurisdiction to 
investigate such reports or to protect the child. 

(U) Certain Indian Country, Special Jurisdiction and crimes against children matters already fall 
within the primary investigative jurisdiction of the FBI. Suspected child abuse, neglect and/or 
sexual exploitation in these areas, which are already the subject of an FBI investigation, do not 
warrant additional reporting unless such reporting is necessary to further protect the child. 

K.2 (U) Mandatory Reporting Laws 

(U) FBI personnel should refer to their state child abuse reporting laws in cases of suspected 
child abuse, neglect and/or sexual exploitation. State laws vary substantially. Some states require 
mandatory reporting of child abuse, neglect and/or sexual exploitation by all persons within their 
boundaries; others require such reporting only from individuals engaged in expressly listed 
occupations. Reports of child abuse, neglect and/or sexual exploitation required by state, local or 
tribal laws shall be made to the agency or entity identified in and in accordance with those laws. 

(U) The federal child abuse reporting law mandates certain professionals (including law 
enforcement personnel and social workers) working on federal land or in a federally operated (or 
contracted) facility must report suspected child abuse to an investigative agency designated by 
the Attorney General to receive and investigate such reports. (42 U.S.C. § 13031(a)). Reports of 
child abuse pursuant to 42 U.S.C. § 1303 1 shall be made to the local law enforcement agency or 
local child protective services agency that has jurisdiction to investigate such reports or to protect 
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child abuse victims in the area or facility in question. When no such agency has entered into a 
formal written agreement with the Attorney General to investigate such reports, the FBI shall 
receive and investigate such reports. (28 C.F.R. § 81.3 (2010)). 

(U) Reporting child abuse in Indian Country is governed by 18 U.S.C. §1169 (2006) and 25 
U.S.C. §3203 (2006). Covered professionals shall report suspected cases of child abuse to the 
federal, state, or tribal agency with primary responsibility for child protection or investigation of 
child abuse within the portion of Indian Country involved. If the report involves a potential crime 
and either involves an Indian Child or an Indian suspect, the local law enforcement agency is 
required to make an immediate report to the FBI. (25 U.S.C. §3203(b) (2)). 

(U) Although mandatory reporting laws vary by jurisdiction, FBI personnel must report 
suspected child abuse, neglect and/or sexual exploitation even if the FBI employee is not 
designated as a mandated reporter under the law. 

K.3 (U) Child Abuse Discovered from a Confidential Source or 

Investigation 

(U) When suspected child abuse, neglect and/or sexual exploitation is based on information 
gathered during a confidential investigation or from a confidential source, FBI personnel should 
make every effort to report the abuse to the appropriate state, local or tribal authorities in order to 
protect the safety of the child. If it is not possible to report the suspected child abuse without 
significantly compromising the investigation or other confidential source such as classified 
information, or endangering public safety, FBI personnel shall obtain guidance from the 
designated Component Responsible Official. 

(U) The Component Responsible Official shall not delegate this responsibility. The Component 
Responsible Official must consult personnel with expertise in the subject matter of child abuse, 
neglect and/or sexual exploitation matters (e.g., Victim Specialist or OVA) and receive a legal 
opinion from the CDC, OGC, or DOJ on the basis for not reporting, to include the potential 
penalties, some of them criminal, and include it in a 188D-EC documenting the decision not to 
report. The Component Responsible Official must monitor the case, and no later than every 30 
days, re-review the case for its ability to be reported, and document in a 188D-EC. Moreover, the 
Component Responsible Official must immediately report the suspected child abuse, neglect 
and/or sexual exploitation, in accordance with this policy, the instant the basis for withholding no 
longer exists. 

K.4 (U) Designated Official 

K.4.1 (U ) Identification of a Designated Official 

(U) The Component Responsible Official must designate a Designated Official in writing via an 
Electronic Communication with case identification number 188D-HQ-A2450935. For field 
offices, the designee may be no lower than an ASAC. For HQ divisions or offices, the designee 
may be no lower than a Unit Chief. 
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K.4.2 (U ) Duties of a Designated Official 

(U) Receive reports of suspected child abuse, neglect and/or sexual exploitation from FBI 
personnel where the incident is alleged to have occurred in a Division or office’s area of 
responsibility. 

(U) Assist FBI personnel with the reporting of suspected child abuse, neglect and/or sexual 
exploitation if the report is not made directly to state, local or tribal authorities by FBI personnel. 

(U) Ensure completion of an Electronic Communication to the FBI’s OVA. 

K.5 (U) Contents of the 188D-EC 

(U) Any 188D-EC prepared under this policy shall reflect all appropriate case identification 
numbers, case identification number 188D-HQ-A2450935, and include, to the extent known and 
applicable, the following information: 

A) (U) Person making the report 

B) (U) When the individual became aware of the suspected child abuse, neglect and/or sexual 
exploitation 

C) (U) Date/time reported to CPS, LE, and/or other investigative agency 

D) (U) CPS/agency ID number (if applicable) 

E) (U) How the report was made (in person, by phone, in writing) 

F) (U) Whether the report was anonymous 

G) (U) Work-related or non-work related incident 

H) (U) Source of the information (direct observation or other) 

I) (U) Location of the incident (federal land, federal facility, or other) 

J) (U) Synopsis of the facts that give reason to suspect child abuse, neglect and/or sexual 
exploitation 

K) 11. (U) General indexing, to include: subject, victim, and addresses 

K.6 (U) Reporting by FBI Personnel Outside of the United States 

Jurisdiction 

(U) FBI personnel assigned or on temporary duty (TDY) outside the United States (U.S.) are also 
responsible for reporting suspected child abuse, neglect and/or sexual exploitation. FBI 
personnel outside the U.S. on personal travel are encouraged to report suspected child abuse, 
neglect and/or sexual exploitation, when practicable. 

(U) Suspected child abuse, neglect and/or sexual exploitation involving U.S. government 
employees or dependents under the Chief of Mission of the U.S. Embassy must be reported to 
the Regional Security Officer and the FBI Designated Official. If the suspected abuse involves 
foreign citizen perpetrators or victims, the FBI personnel should consult with the Legal Attache 
(LEGAT) and/or Regional Security Officer in the Embassy regarding any reporting laws of the 
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foreign country and act accordingly. Contact for the purpose of reporting or notice of the 
reporting contact may be made by the FBI LEGAT to the host government. FBI personnel should 
also notify the FBI’s OVA via the division Designated Official and a 188D-EC. 

K.7 (U) Conflicts of Law or Policy 

(U) This policy does not authorize any exception to laws requiring mandatory reporting of 
suspected child abuse, neglect and/or sexual exploitation. 

(U) If there is an apparent conflict with the law and this policy, consult your supervisory chain 
and seek a legal opinion from your respective CDC or the OGC. 

K.8 (U) Definitions 

K.8.1 (U) Child 

(U) A person under the age of 18 years. See also the Guidelines (Article IV.I.5; p.32) for 
notification obligations and specialized procedures on notifying child victims after they reach the 
age of majority. 

K.8. 2 (U) Child Abuse 

(U) The physical or mental injury, sexual abuse or sexual exploitation, or negligent treatment of 
a child. 

K.8. 3 (U) Sexual Abuse 

(U) Includes rape, molestation, or incest with children. 

K.8.4 (U) Sexual Exploitation 

(U) Includes the production, distribution, receipt, possession, or access of child pornography, as 
well as the commercial sexual exploitation of children (prostitution), and the employment, use, 
persuasion, inducement, enticement, or coercion of a child to engage in, or assist another person 
to engage in, sexual abuse or sexual exploitation of children. 

K.8.5 (U) Negligent Treatment 

(U) The failure to provide adequate food, clothing, shelter, or medical care so as to seriously 
endanger the physical health of the child. 

K.8. 6 (U) Not Child Abuse 

(U) Child abuse does not include discipline administered by a parent or legal guardian to his or 
her child provided it is reasonable in manner and moderate in degree and otherwise does not 
constitute cruelty. 
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K.9 (U) FBI Personnel 

(U) Any FBI employee or affiliated person authorized by appropriate authority to participate in 
an FBI investigation, activity or mission, who is under the control and authority of the FBI. As in 
accordance with DIOG Section 2.1 1. 

(U) This “includes, but is not limited to: an operational/administrative professional support 
person, intelligence analyst, special agent, task force officer (TFO), task force member (TFM), 
task force participant (TFP), detailee, and FBI contractor;” as well as a confidential human 
source (CHS) “when operating pursuant to the tasking or instructions of an FBI employee.” 

K. 10 (U) "Reason to Suspect Child Abuse, Neglect or Exploitation” 

(U) Reason to suspect child abuse, neglect and/or sexual exploitation means FBI personnel who 
witness suspected child abuse, neglect and/or sexual exploitation by either personally seeing or 
hearing it, or learning of facts that give reason to suspect child abuse, neglect and/or sexual 
exploitation. Becoming a witness includes if the suspected child abuse, neglect. 
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APPENDIX L: (U) ON-LINE INVESTIGATIONS 


(U) (Note: The policy for On-Line Investigations was not completed by the time of the DIOG 
publication. It will be linked in the DIOG once approved.) 
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APPENDIX M: (U) THE FAIR CREDIT REPORTING ACT (FCRA) 

(U) (Note: The policy for The Fair Credit Reporting Act was not completed by the time of the 
DIOG publication. It will be linked in the DIOG once approved.) 
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APPENDIX N: (U) TAX RETURN INFORMATION 


(U) (Note: The policy for Tax Return Information was not completed by the time of the DIOG 
publication. It will be linked in the DIOG once approved.) 
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APPENDIX 0: (U) RIGHT TO FINANCIAL PRIVACY ACT (RFPA) 

(U) (Note: The policy for the Right to Financial Privacy Act was not completed by the time of 
the DIOG publication. It will be linked in the DIOG once approved.) 
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APPENDIX P: (U) ACRONYMS 


A/EAD 

Associate Executive Assistant Director 

AD 

Assistant Director 

ADD 

Associate Deputy Director 

ADIC 

Assistant Director-in-Charge 

AFID 

Alias False Identification 

AG 

Attorney General 

AGG 

Attorney General Guidelines 

AGG-CHS 

Attorney General Guidelines Regarding the Use of FBI Confidential Human 
Sources 

AGG-Dom 

Attorney General’s Guidelines for Domestic FBI Operations 

AGG-UCO 

The Attorney General’s Guidelines on FBI Undercover Operations 

AOR 

Area of Responsibility 

ARS 

Assessment Review Standards 

ASAC 

Assistant Special Agent in Charge 

ASC 

Assistant Section Chief 

ATF 

Bureau of Alcohol, Tobacco, Firearms and Explosives 

AUSA 

Assistant United States Attorney 

CALEA 

Communications Assistance for Law Enforcement Act 

CCRSB 

Criminal Cyber Response and Services Branch 

CD 

Counterintelligence Division 
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CDC 

Chief Division Counsel 

C.F.R. 

Code of Federal Regulations 

CHS 

Confidential Human Source 

CHSPG 

Confidential Human Source Policy Implementation Guide 

CIA 

Central Intelligence Agency 

CID 

Criminal Investigative Division 

CMS 

Collection Management Section 

CPO 

Corporate Policy Office 

CUORC 

Criminal Undercover Operations Review Committee 

CyD 

Cyber Division 

DAD 

Deputy Assistant Director 

DD 

Deputy Director 

DEA 

Drug Enforcement Administration 

DGC 

Deputy General Counsel 

DI 

Directorate of Intelligence 

DLAT 

Deputy Legal Attache 

DNI 

Director of National Intelligence 

DOD 

Department of Defense 

DOJ 

Department of Justice 

DOJ OEO 

Office of Enforcement Operations, DOJ 


DOS Department of State 
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DPO 

Division Policy Officer 


EAD 

Executive Assistant Director 

EC 

Electronic Communication 

ECF 

Electronic Case File 

ECPA 

Electronic Communication Privacy Act 

ECS 

Electronic Communication Service 


El 

Enterprise Investigation 

ELSUR 

Electronic Surveillance 

EO 

Executive Order 

EOT 

ELSUR Operations Technician 

ERS 

ELSUR Records System 

ESN 

Electronic Serial Number 

ESU 

DOJ OEO, Electronic Surveillance Unit 

ETR 

Electronic Technical Request 

FBIHQ 

FBI Headquarters 

FGJ 

Federal Grand Jury 

FGUSO 

Field Guide for Undercover and Sensitive Operations 

FICP 

Foreign Intelligence Collection Program 

FIG 

Field Intelligence Group 
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FISA 

Foreign Intelligence Surveillance Act 

FISC 

Foreign Intelligence Surveillance Court 


FRCP 

Federal Rules of Criminal Procedure 

GC 

General Counsel 


HIPAA 

Health Insurance Portability and Accountability Act 

HSC 

Homeland Security Council 

ICE 

Department of Homeland Security Immigration and Customs Enforcement 

ICM 

Investigative Case Management 

IINI 

Innocent Images National Initiative 

ILB 

Investigative Law Branch 

ILU 

Investigative Law Unit 

IOB 

Intelligence Oversight Board 

IOD 

International Operations Division 

IP Address 

Internet Protocol Address 

IPG 

Intelligence Policy Implementation Guide 

ISP 

Internet Service Provider 

ITSMV 

Interstate Transportation of Stolen Motor Vehicles 

JDA 

Juvenile Delinquency Act 

JTTF 

Joint Terrorism Task Force 
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LEGAT 

Legal Attache 

LHM 

Letterhead Memorandum 

LO 

Lead Office 

MAR 

Monthly Administrative Report 

MLAT 

Mutual Legal Assistance Treaties 

MOU/MOA 

Memorandum of Understanding/Agreement 

MSIN 

Mobile Station Identification Number 

MST 

Mobile Surveillance Team 

MST-A 

Mobile Surveillance Team — Armed 

NARA 

National Archives and Records Administration 

NCMEC 

National Center for Missing and Exploited Children 

NISS 

National Information Sharing Strategy 

NSB 

National Security Branch 

NSC 

National Security Council 

NSD 

National Security Division, DOJ 

NSL 

National Security Letter 

NSLB 

National Security Law Branch 

NSSE 

National Special Security Events 

NSUCOPG 

National Security Undercover Operations Policy Implementation Guide 

OCA 

Office of Congressional Affairs 

OCRS 

Organized Crime and Racketeering Section, DOJ 
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OGC 

Office of the General Counsel 

OLA 

Otherwise Illegal Activity 

OIC 

Office of Integrity and Compliance 

OIO 

Office of Operations, DOJ 

OLC 

Office of Legal Counsel, DOJ 

OO 

Office of Origin 

OPA 

Office of Public Affairs 

OTD 

Operational Technology Division 

PBDM 

Pattern Based Data Mining 

PCHS 

Potential CHS 1 

PCLU 

Privacy and Civil Liberties Unit 

PCTDD 

Post Cut-through Dialed Digits 

PFI 

Positive Foreign Intelligence 

PG 

Policy Implementation Guide 

PI 

Preliminary Investigation 

PIA 

Privacy Impact Assessment 

PIAB 

President’s Intelligence Advisory Board 

PSA 

Performance Summary Assessments 

PTA 

Privacy Threshold Analysis 

RA 

Resident Agency 
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RF 

Radio Frequency 

RFPA 

Right to Financial Privacy Act 

RICO 

Racketeer Influenced and Corrupt Organizations 

RIG 

Regional Intelligence Group 

RMD 

Records Management Division 

SA 

Special Agent 

SAC 

Special Agent-in-Charge 

SC 

Section Chief 

SLA 

Supervisory Intelligence Analyst 

SIM 

Sensitive Investigative Matter 

SORC 

Sensitive Operations Review Committee 

SSA 

Supervisory Special Agent 

SSRA 

Supervisory Senior Resident Agent 

TFM 

Task Force Member 

TFO 

Task Force Officer 

TFP 

Task Force Participant 

TMD 

Technical Management Database 

TTA 

Technically Trained Agent 

UC 

Unit Chief 

UCE 

Undercover Employee 

UCFN 

Universal Case File Number 
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uco 

Undercover Operation 

UCRC 

Undercover Review Committee 

UDP 

Undisclosed Participation 

UNI 

Universal Index 

USA 

United States Attorney 

USAO 

United States Attorney’s Office 

U.S.C. 

United States Code 

USG 

United States Government 

USIC 

United States Intelligence Community 

USIC 

United States Intelligence Community , 

USIC 

United States Intelligence Community 

USPER 

United States Person, United States Persons, US PER, USPERs, US Person, 
US Persons, U.S. Person, U.S. Persons 

USPS 

United States Postal Service 

USSS 

United States Secret Service 

VICAP 

Violent Criminal Apprehension Program 

VS 

Victim Specialist 

WITT 

Wireless Intercept Tracking Technology 

WMD 

Weapons of Mass Destruction 

WMDD 

Weapons of Mass Destruction Directorate 
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APPENDIX Q: (U) DEFINITIONS 

(U//FOUO) Academic Nexus SIMJ I 


(U) Aggrieved Person: 


(U//FOUO) Assessments: The AGG-Dom authorizes as an investigative activity called an 
“Assessment” which requires an authorized purpose and articulated objective(s). The DIOG 
defines five types of Assessments that may be carried out to detect, obtain information about, or 
prevent or protect against federal crimes or threats to the national security or to collect foreign 
intelligence. Although “no particular factual predication” is required, the basis of an Assessment 
cannot be arbitrary or groundless speculation, nor can an Assessment be based solely on the 
exercise of First Amendment protected activities or on the race, ethnicity, national origin or 
religion of the subject, or a combination of only those factors. 

(U//FOUO) Closed Circuit Television (CCTV): a fixed-location video camera that is typically 
concealed from view or that is placed on or operated by a consenting party. 

(U) Consensual Monitoring: Monitoring of communications for which a court order or warrant 
is not legally required because of the consent of a party to the communication. 

(U) Electronic Communication Service: Any service that provides to users thereof the ability 
to send or receive wire or electronic communications. For example, telephone companies and 
electronic mail companies generally act as providers of electronic communication services. 

(U) Electronic Communications System: Any wire, radio, electromagnetic, photooptical or 
photoelectronic facilities for the transmission of wire or electronic communications, and any 
computer facilities or related electronic equipment for the electronic storage of such 
communications. 

(U) Electronic Storage: Any temporary, intermediate storage of a wire or electronic 
communication incidental to the electronic transmission thereof, or any storage of such 
communication by an electronic communication service for purposes of backup protection of 
such communication. In short, "electronic storage" refers only to temporary storage, made in the 
course of transmission, by a provider of an electronic communication service. 

(U//FOUO) Electronic Tracking Device:| 
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(U//FOUO) Employee: For purposes of the AGG-Dom and DIOG, an “FBI employee” includes, 
but not limited to, an operational/administrative professional staff person, intelligence analyst, 
special agent, task force officer (TFO), task force member (TFM), task force participant (TFP), 
detailee, and FBI contractor. An FBI employee is bound by the AGG-Dom and DIOG. The FBI 
employee definition excludes a confidential human source (CHS). 

(U//FOUO) Enterprise: The term “enterprise” includes any individual, partnership, corporation, 
association, or other iegal entity, and any union or group of individuals associated in fact 
although not a legal entity. 

(U//FOUO) Enterprise Investigation: An Enterprise Investigation (El) examines the structure, 
scope, and nature of the group or organization including: its relationship, if any, to a foreign 
power; the identity and relationship of its members, employees, or other persons who may be 
acting in furtherance of its objectives; its finances and resources; its geographical dimensions; its 
past and future activities and goals; and its capacity for harm. (AGG-Dom, Part II.C.2) 

(U//FOUO) Enterprise Investigations are a type of Full Investigation and are subject to the same 
requirements that apply to Full Investigations described in Section 7. Enterprise Investigations 
focus on groups or organizations that may be involved in the most serious criminal or national 
security threats to the public, as described in Section 8. Enterprise Investigations cannot be 
conducted as Preliminary Investigations or Assessments, nor may they be conducted for the sole 
purpose of collecting foreign intelligence 


(U//FOUO) Extraterritorial Guidelines: The guidelines for conducting investigative activities 
outside of the United States are currently contained in: (i) The Attorney General’s Guidelines for 
Extraterritorial FBI Operations and Criminal Investigations', (ii) The Attorney General’s 
Guidelines for FBI National Security Investigations and Foreign Intelligence Collection', and 
(iii) The Attorney General Guidelines on the Development and Operation of FBI Criminal 
Informants and Cooperative Witnesses in Extraterritorial Jurisdictions (collectively, the 
Extraterritorial Guidelines); (iv) The Attorney General Procedure for Reporting and Use of 
Information Concerning Violations of Law and Authorization for Participation in Otherwise 
Illegal Activity in FBI Foreign Intelligence, Counterintelligence or International Terrorism 
Intelligence Investigations (August 8, 1988); and (v) the Memorandum of Understanding 
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Concerning Overseas and Domestic Activities of the Central Intelligence Agency and the 
Federal Bureau of Investigation (2005). 

(U//FOUO) FISA: The Foreign Inteligence Surveillance Act of 1978, as amended. The law 
establishes a process for obtaining judicial approval of electronic surveillance, physical searches, 
pen register and trap and trace devices, and access to certain business records for the purpose of 
collecting foreign intelligence. 

(U) For or On Behalf of a Foreign Power: The determination that activities are for or on behalf 
of a foreign power shall be based on consideration of the extent to which the foreign power is 
involved in control or policy direction; financial or material support; or leadership, assignments, 
or discipline. 

(U) Foreign Computer Intrusion: The use or attempted use of any cyber-activity or other 
means, by, for, or on behalf of a foreign power to scan, probe, or gain unauthorized access into 
one or more United States-based computers. 

(U) Foreign Intelligence: Information relating to the capabilities, intentions, or activities of 
foreign governments or elements thereof, foreign organizations or foreign persons, or 
international terrorists. 

(U) Foreign Intelligence Requirements: 

A) (U//FOUO) National intelligence requirements issued pursuant to authorization by the 
Director of National Intelligence, including the National Intelligence Priorities Framework and 
the National HUMINT Collection Directives, or any successor directives thereto; 

B) (U//FOUO) Requests to collect foreign intelligence by the President or by Intelligence 
Community officials designated by the President; and 

C) (U//FOUO) Directions to collect foreign intelligence by the Attorney General, the Deputy 
Attorney General, or an official designated by the Attorney General. 

(U) Foreign Power: A foreign government or any component thereof, whether or not recognized 
by the United States; a faction of a foreign nation or nations, not substantially composed of 
United States persons (USPERs); an entity that is openly acknowledged by a foreign government 
or governments to be directed and controlled by such foreign government or governments; a 
group engaged in international terrorism or activities in preparation therefore; a foreign-based 
political organization, not substantially composed of USPERs; or an entity that is directed or 
controlled by a foreign government or governments. 

(U) Full Investigation: A Full Investigation may be opened if there is an “articulable factual 
basis” for the investigation that reasonably indicates one of the following circumstances exists: 

(U) An activity constituting a federal crime or a threat to the national security has or may have 
occurred, is or may be occurring, or will or may occur and the investigation may obtain 
information relating to the activity or the involvement or role of an individual, group, or 
organization in such activity; 

A) (U) An individual, group, organization, entity, information, property, or activity is or may be a 
target of attack, victimization, acquisition, infiltration, or recruitment in connection with 
criminal activity in violation of federal law or a threat to the national security and the 
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investigation may obtain information that would help to protect against such activity or threat; 
or 

B) (U) The investigation may obtain foreign intelligence that is responsive to a PFI requirement, 
as defined in DIOG Section 7.4.3. 

(U) All lawful investigative methods may be used in a Full Investigation. 

(U) A Full Investigation of a group or organization may be opened as an Enterprise Investigation 
if there is an articulable factual basis for the investigation that reasonably indicates the group or 
organization may have engaged, or may be engaged in, or may have or may be engaged in 
planning or preparation or provision of support for: 

A) (U) Racketeering Activity: 

1) (U) A pattern of racketeering activity as defined in 18 U.S.C. § 1961(5); 

B) (U) International Terrorism: 

1) (U) International terrorism, as defined in the AGG-Dom, Part VII. J, or other threat to the 
national security; 

C) (U) Domestic Terrorism: 

1) (U) Domestic terrorism as defined in 18 U.S.C. § 2331(5) involving a violation of federal 
criminal law; 

2) (U) Furthering political or social goals wholly or in part through activities that involve 
force or violence and a violation of federal criminal law; or 

3) (U) An offense described in 1 8 U.S.C. § 2332b(g)(5)(B) or 1 8 U.S.C. § 43. 

(U) Human Source: A Confidential Human Source as defined in the Attorney General’s 
Guidelines Regarding the Use of FBI Confidential Human Sources. 

(U) Intelligence Activities: Any activity conducted for intelligence purposes or to affect 
political or governmental processes by, for, or on behalf of a foreign power. 

(U) International Terrorism: Activities that involve violent acts or acts dangerous to human 
life that violate federal, state, local, or tribal criminal law or would violate such law if committed 
within the United States or a state, local, or tribal jurisdiction; appear to be intended to intimidate 
or coerce a civilian population; to influence the policy of a government by intimidation or 
coercion; or to affect the conduct of a government by assassination or kidnapping; and occur 
totally outside the United States, or transcend national boundaries in terms of the means by 
which they are accomplished, the persons they appear to be intended to coerce or intimidate, or 
the locale in which their perpetrators operate or seek asylum. 

(U//FOUO) National Security Letters: an administrative demand for documents or records that 
can be made by the FBI during a Predicated Investigation relevant to a threat to national security. 

The standard for issuing an NSL, except under 15 U.S.C. § 1681v, is relevance to an authorized 
investigation to protect against international terrorism or clandestine intelligence activities, 
provided that such an investigation of a United States person (USPER) is not predicated solely 
on activities protected by the First Amendment of the Constitution of the United States. 

- — — — — - — — ——j b7E 
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(U//FOUO) Operational Division or Operational Unit: “Operational” division or operational 
unit as used in the DIOG means the FBIHQ division or unit responsible for management and 
program oversight of the file classification for the substantive investigative matter (i.e., 
Assessment or Predicated Investigation). Previously referred to as the FBIHQ “substantive” 
division or substantive unit. 


(U//FOUO) Pen Register Device: Records or decodes dialing, routing addressing or signaling 
information transmitted by an instrument or facility from which a wire or electronic 
communication is transmitted, provided that such information must not include the contents of 
any communication. 


(U//FOUO) Physical Surveillance (Not Requiring a Court Order): The deliberate observation 
by an FBI employee of persons, places, or events, on either a limited or continuous basis, in 
areas where there is no reasonable expectation of privacy. Note: DIOG Section 18.5.8 makes a 
distinction between “casual observation” and physical surveillance, and specifies factors to be 
considered when determining whether a particular plan of action constitutes casual observation 
or physical surveillance. (See DIOG Section 18.5.8) 


(U) Preliminary Investigation: A Preliminary Investigation is a type of Predicated Investigation 
authorized under the AGG-Dom that may be opened (predicated) on the basis of any “allegation 
or information” indicative of possible criminal activity or threats to the national security. 
Preliminary Investigations may be opened to detect, obtain info nnation about, or prevent o r 
protect against federal crimes or threats to the national securitv.l 


(U) Proprietary: A sole proprietorship, partnership, corporation, or other business entity 
operated on a commercial basis, which is owned, controlled, or operated wholly or in part on 
behalf of the FBI, and whose relationship with the FBI is concealed from third parties. 


(U) Provider of Electronic Communication Services: Any service that provides the user 
thereof the ability to send or receive wire or electronic communications. 


(U) Publicly Available: Information that has been published or broadcast for public 
consumption, is available on request to the public, is accessible on-line or otherwise to the 
public, is available to the public by subscription or purchase, could be seen or heard by any 
casual observer, is made available at a meeting open to the public, or is obtained by visiting any 
place or attending any event that is open to the public. 

(U) Records: Any records, databases, files, indices, information systems, or other retained 
information. 


(U) Relevance: Information is relevant if it tends to- make a fact of consequence more or less 
probable. 
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(U//FOUO) Remote Computing Services: 


(U//FOUO) Sensitive Investigative Matter: An investigative matter involving a domestic 
public official, domestic political candidate, religious or domestic political organization or 
individual prominent in such an organization, or news media, or an investigative matter having 
academic nexus, or any other matter which, in the judgment of the official authorizing an 
investigation, should be brought to the attention of FBIHQ and other DOJ officials. 

(U) Sensitive Monitoring Circumstance: Investigation of a member of Congress, a federal 
judge, a member of the Executive Branch at Executive Level IV or above, or a person who has 
served in such capacity within the previous two years; (Note: Executive Levels I through IV are 
defined in 5 U.S.C. §§ 5312-5315.) 

A) (U) Investigation of the Governor, Lieutenant Governor, or Attorney General of any state or 
territory, or a judge or justice of the highest court of any state or territory, concerning an 
offense involving bribery, conflict of interest, or extortion related to the performance of 
official duties; 

B) (U) A party to the communication is in the custody of the Bureau of Prisons or the United 
States Marshals Service or is being or has been afforded protection in the Witness Security 
Program; or 

C) (U) The Attorney General, the Deputy Attorney General, or an Assistant Attorney General has 
requested that the FBI obtain prior approval for the use of consensual monitoring in a specific 
investigation. 

(U) Special Agent in Charge: The Special Agent in Charge of an FBI field office (including an 
Acting Special Agent in Charge), except that the functions authorized for Special Agents in 
Charge by these Guidelines may also be exercised by the Assistant Director in Charge or by any 
Special Agent in Charge designated by the Assistant Director in Charge in an FBI field office 
headed by an Assistant Director, and by FBI Headquarters officials designated by the Director of 
the FBI. 

(U) Special Events Management: Planning and conduct of public events or activities whose 
character may make them attractive targets for terrorist attack. 

(U) State, Local, or Tribal: Any state or territory of the United States or political subdivision 
thereof, the District of Columbia, or Indian tribe. 

(U//FOUO) Surveillance: 

A) (U//FOUO) Electronic surveillance (ELSUR) - under Title III and FISA is the non- 

consensual electronic collection of information (usually communications) under circumstances 
in which the parties have a reasonable expectation of nrivacv and court orders or warrants are 
renniredJ I 
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B) (U//FOUO) Consensual monitoring of communications, including consensual computer 
monitoring, or electronic surveillance (ELSUR) - where there is no reasonable expectation 
of privacy is permitted in Predicated Investigations. These methods usually do not require 
court orders or warrants unless they involve an intrusion into an area where there is a 
reasonable expectation of privacy or non-consensual monitoring of comm unications, but legal 
review is generally required to ensure compliance with legal requirements! ~| 


(U//FOUO) Physical surveillance - is the deliberate observation by an FBI employee of 
persons, places, or events, on either a limited or continuous basis, in areas where there may or 
may not be a reasonable expectation of privacy. (See DIOG Section 18.5.8 for physical 
surveillance in situations not requiring a court order and a discussion of the distinction 



(U) Threat to the National Security: International terrorism; espionage and other intelligence 
activities, sabotage, and assassination, conducted by, for, or on behalf of foreign powers, 
organizations, or persons; foreign computer intrusion; and other matters determ in ed by the 
Attorney General, consistent with Executive Order 12333 or a successor order. 

(U//FOUO) Trap and Trace Device: Captures the incoming electronic or other impulses that 
identify the originating number or other dialing, routing, addressing or signaling information 
reasonably likely to identify the source of a wire or electronic communication, provided that 
such information does not include the contents of any communication. 

(U//FOUO) Undercover Activity: An “undercover activity” is any investigative activity 
involving the use of an assumed identity by an undercover employee for an official purpose, 
investigative activity, or function. 

(U//FOUO) Undercover Employee: An employee of the FBI, another federal, state, or local law 
enforcement agency, another entity of the United States Intelligence Community (USIC), or 
another foreign intelligence agency working under the direction and control of the FBI whose 
relationship with the FBI is concealed from third parties by the maintenance of a cover or alias 
identity for an official purpose, investigative activity, or function. 

(U//FOUO) Undercover Operation: An “undercover operation” is an operation that involves a 
series of related “undercover activities” over a period of time by an “undercover employee.” A 
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series of related undercover activities consists of more than five s eparate substantive contacts by 
an undercover employee with the individuals under investigation.1 j 
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(U) United States: When used in a geographic sense, means all areas under the territorial 
sovereignty of the United States. 

(U) United States Person (USPER): Any of the following, but not including any association or 
corporation that is a foreign power, defined as an entity that is openly acknowledged by a foreign 
government or governments to be directed and controlled by such foreign government or 
governments: 

A) (U) An individual who is a United States citizen or an alien lawfully admitted for permanent 
residence; 

B) (U) An unincorporated association substantially composed of individuals who are United 
States persons (USPERs); or 

C) (U) A corporation incorporated in the United States. 

(U) If a group or organization in the United States that is affiliated with a foreign-based 
international organization operates directly under the control of the international organization 
and has no independent program or activities in the United States, the membership of the entire 
international organization shall be considered in determ inin g whether it is substantially 
composed of USPERs. If, however, the United States-based group or organization has programs 
or activities separate from, or in addition to, those directed by the international organization, only 
its membership in the United States shall be considered in determining whether it is substantially 
composed of USPERs. A classified directive provides further guidance concerning the 
determination of USPER status. 

(U) Use: When used with respect to human sources, means obtaining information from, tasking, 
or otherwise operating such sources. 
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APPENDIX R: (U) SUPERCEDED DOCUMENTS AND NFIPM, MIOG, 
AND MAOP SECTIONS 


(U//FOUO) This guide supersedes the following FBI policies and procedures: 


jjl- Part 

Section 

Section Title j 

DIOG 1 Supersession i 

DIOG 2 Supersession 

MIOG Intro 

Preface 

Section: Preface (1) 

DIOG Preamble 

DIOG Preamble 

MIOG intro 

Preface 

Preface 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 1 

Section: SI: Investigative Authority and 
Responsibility (12) 

DIOG Preamble 

DIOG Preamble 

MIOG Into 

Section 1 

1-1 AUTHORITY OF A SPECIAL AGENT 

DIOG-preamble. 

DIOG Preamble 

MIOG Into 

Section 1 

1-2 INVESTIGATIVE RESPONSIBILITY 

DIOG Preamble 

DIOG Preamble 

MIOG Into 

Section 1 

1-3 THE ATTORNEY GENERALS'GUIDELINES ON 
GENERAL CRIMES, RACKETEERING ENTERPRISE . 
AND TERRORISM ENTERPRISE-INVESTIGATIONS 

DIOG Preamble 

DIOGPreamble 

MIOG Intro 

Section 1 

1-3 INTRODUCTION 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 1 

1-31. GENERAL PRINCIPLES 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 1 

1-3 II. GENERAL CRIMES INVESTIGATIONS 

DIOG Preamble 

DIOG Preamble 

MIOG into 

Section 1 

1-3 III. CRIMINAL INTELLIGENCE INVESTIGATIONS 

DIOG Preamble 

DIOG Preamble- 

MIOG Intro 

Section 1 

1-3 IV. INVESTIGATIVE TECHNIQUES 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 1 

1-3 V. DISSEMINATION AND MAINTENANCE OF 
INFORMATION 

DIOGPreamble 

DIOG Preamble 

MIOG Intro 

Section 1 

1-3 VI. COUNTERTERRORISM ACTIVITIES AND 
OTHER AUTHORIZATIONS 

DIOG Preamble 

DIOG Preamble 

MIOGInto 

Section 1 

1-3 VII RESERVATION 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 1 

14 INVESTIGATIVE AUTHORITY AND THE FIRST 
AMENDMENT 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

Section ; $2: Management and Allocation Programs (57) 

DIOG Preamble 

DIOG Preamble t 

MIOG Intro 

Section 2 

2-1 NATIONAL PRIORITY PROGRAMS 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-1.1 Foreign Counterintelligence (FCI) 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-1. 1.1 Definition 

DIOG Preamble 

DIOG Preamble 


Section 2 

2-11.2 Objective 

DIOGPreamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-1.2 Organized Crime 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-12.1 Definition 

DIOGPreamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-1 .2.2 Objective 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

24 .2.3 Ranking of Organized Criminal Activities 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-1.3 Drug 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-13.1 Definition 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-13.2 Objective 

DIOG Preamble 

DIOG Preamble 

' MIOG Intro 

Section 2 

24 .4 Counterterrorism 

DIOGPreamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-1 .4.1 Definition 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-1 .4.2 Objective 

DIOGPreamble 

DIOG Preamble 

MIOG Intro 

Section 2 

24.5 White-Collar Crime 

DIOG Preamble 

DIOG Preamble 
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Part 

Section 

Section Title 

i| DIOG 1 Supersession i 

DIOG 2 Supersession 

MIOGIntro 

Section 2 

2-15.1 Definition 

DIOG Preamble 

DIOGPreamble 

MIOG Intro 

Section 2 

2-1 ,5.2 Objective 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-15.3 Ranking of Activities 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-16 Violent Crimes and Major Offenders 

DIOG Preamble 

DIOG Preamble 

MIOGIntro 

Section 2 

2-1 .6.1 Fugitive Subprogram 

DIOG Preamble; 

DIOG Preamble 

MIOG Intro 

Section 2 

2-16.2 Government Reservation Crimes Subprogram 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-1. 6. 3 Interstate Theft.Subprogram 

DIOG Preamble 

DIOGPreamble 

MIOG Intro 

Section 2 

2-16.4 Violent Crimes Subprogram 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-1. 6.5 Violent Crimes and Major Offenders-Organized 
Crime Drug Enforcement Task Force Subprogram 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-2 OTHER PROGRAMS 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-2.1 Deleted 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-2.1. 1 Deleted 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-2.1-2 Deleted 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-2.13 Deleted 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-2.2 Applicant investigations - Reimbursable.and 
Nonreimbursable 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-2.2. 1 Definition 

DIOG Preamble 

DIOG Preamble 

MIOGIntro 

Section 2 

2-2, 2.2 Objective- 

DIOGPreamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-2.2.3 Ranking of Activities 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-2.3 Civil Rights 

DIOGPreamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-2.3. 1 Definition 

DIOG Preamble 

DIOG Preamble 

MIOGIntro 

Section 2 

2-2.3.2 Objective 

DIOG Preamble 

. DIOG Preamble 

MIOG Intro 

Section 2 

2-2.3.3 Ranking of Activities 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-24 FBI Security Program 

DIOG Preamble 

DIOGPreamble 

MIOG Intro 

Section 2 

2-2.4. 1 Definition 

DIOG Preamble 

DIOG Preamble 

MIOG Intro- 

Section 2 

2-2.42 Objective 

DIOG Preamble 

DIOGPreamble 

MIOG Intro 

Section 2 

2-24.3 Ranking of Activities 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

1-2.5 “Deleted 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-2.5. 1 Deleted 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-2, 5.2 Deleted 

DIOGPreamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-2.5.3 Deleted 

DIOG Preamble 

DIOG Preamble 

MIOGIntro 

Section 2 

2-2,6Deleted 

DIOG Preamble 5 

DIOG Preamble 

MIOG Intro 

Section 2 

2-2.6. 1 Deleted 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-2^2 Deleted 

DIOG Preamble 

DIOGPreamble 

MIOG Intro 

Section 2 

2-2.6.3 Deleted 

DIOG Preamble 

DIOG Preamble 

MIOG Intro ~ 

Section 2 

2-2J Deleted 

DIOG Preamble 

DIOGPreamble " 

MIOG Intro 

Section 2 

2-2.7. 1 Deleted 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-2 .7^2 Deleted. 

^DiOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-2.7.3 Deleted 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2r2.8 Deleted 

DIOG Preamble 

DIOG Preamble 
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■’ Section 

Section Title j 

j DIOG 1 Supersession 

I DIOG 2 Supersession 

MIOG Intro 

Section 2 

2-2.8. 1 Deleted 

DIOG Preamble 

DIOG Preamble 

MfOGJntro 

Section 2 

2-2.S.2 Deleted 

DIOG Preamble 

DIOG Preamble 

MIOG Intro 

Section 2 

2-2.8.3 Deleted 

DIOG Preamble 

DIOG Preamble 

MIOG'1.1 

Section 7 

7-5 CLARIFICATIONREGARDING AN INVESTIGATION 
AS OPPOSED TO A- PRELIMINARY INQUIRY 


DIOG 5, 6 and 7 

MIOG 1.1 

Section 7 

7-6 DEPARTMENTAL INSTRUCTIONS REGARDING 
QUESTIONABLE CASES 


Paragraphs #1 and 2 
only. DIOG 5, 6 and 7 

MIOG M 

Section 7 

7-20 ADMIN1STRATIVE.SUBPOENAS IN CHILD ABUSE 
AND CHILD SEXUAL EXPLOITATION (CSE) CASES 


DIOG 18.6.4 

MIOG l.l 

Section 9 

9-7.2 Use of Closed Circuit Television (CCTV) 


Paragraphs #2 (all sub- 
parts); 3 (all sub-parts); 
and 4 only. DIOG 18.6.3 

MIOGI.I 

Section 62 

62-3 DOMESTIC POLICE COOPERATION - STATUTE 



MIOG l.l 

Section 62 

62-3.3 Policy 


Paragraphs # 5 and 6 
only. DIOG 12 

MIOGI.I 

Section 62 

62-3.4 Office of Origin 


DIOG 14 

MIOG l.l 

Section 62 

62-3.5 Classification 


DIOG 12. See new 343 
classification 

MIOG 1.2 

Section 157 

Section : S157 Civil Unrest (8} 


DIOG 12 

MIOG 1.2 

Section 157 

157-1 RESPONSIBILITY OF THE BUREAU 


DIOG 12 

MIOG 1.2 

Section 157 

157-11 Categories for Reporting 


. DIOG 12 

MIOG 1.2 

Section 157 

157-2 POLICY REGARDING REPORTING OF CIVIL 
DISORDERS 


DIOG 12 

MIOG 1.2 

Section 157 

157-3 REPORTING OF DEMONSTRATIONS 


DIOG 12 

MIOG 1.2 

Section 157 

157-4 PHOTOGRAPHIC SURVEILLANCES 


DIOG 12 

MIOG 1:2 

Section 157 

157-5 DISSEMINATION OF DATA PERTAINING TO 
CIVIL DISORDERS AND DEMONSTRATIONS 


DIOG 12 

MIOG 1.2 

Section 157 

157-6 REPORTING PROCEDURES TO BE UTILIZED IN 
CIVIL DISORDERS AND DEMONSTRATIONS 


DIOG 12 

MIOG12 " 

Section 157 

15T-7CHARACTER 


" ~DIOG12 

MIOG 1.2 

Section 161 

161-10 DISSEMINATION TO THE WHITE HOUSE 
COMPLEX (WHC) 


DIOG 14, 18 

MIOG 12 

Section 163 

1 63-1 .1 Investigative Request 


DIOG 12 

MIOG 1.2 

Section 163 

163-2 INVESTIGATIVE INSTRUCTIONS AND 
PROCEDURES 


DIOG 12 

MIOG 1.2 

Section 163 

163-2.1 Opening Foreign Police Cooperation (FPC) - 
Genera! Criminal Matters (GCM) 


* DIOG 12.2 

MIOG 1.2 

Section 163 

163-2.1.1 Letter Rogatory Process 


DIOG 12 

MIOG 1,2 

Section 163 

163-3 REQUESTS FOR TERRORISM ENTERPfisE ~ 
INVESTIGATIONS 


DIOG 8 and 12 

MIOG 1.2 

„„„ 

Section 163 

163-6 REPORTING 


DIOG 12 


Section 163 

163-7 RULE 6(E) I^TErIaE 


DIOG 18 

MIOG 1.2 

Section 163 

163-8 PRIVACY ACT 


DIOG 14 

MIOG 1.2 

Section 163 

163-9 RIGHT TO FINANCIAL PRIVACY ACT 


DIOG Appendix 0 
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i Pari 

Section 

Section Title 

DIOG 1 Supersession 

DIOG 2 Supersession 

MIOG 1.2 

Section 288 

288-5.1 Accessing Computer Records - Summary of 
Compelled Disclosure under Title 18, USC, Section 2703 


DIOG 18.6.8 

MIOG 1.2 

Section 288 

288-5.1 .1 Subpoena - ECPA Requirements 


DIOG 18.613 ~ 

MIOG 1.2 

Section 288 

288-5.1 .2 Subpoena with Prior Notice to the Subscriber or 
Customer 


DIOG 18.6.8 

MIOG (.2 

Section 288 

288,5.1.3 Section 2703(d) Order " 


DIOG 18.6.8 

MIOG 1.2 

Section 288 

288-5.1.4 Section 2703(d) Order with Prior Notice to the 
Subscriber or Customer 


DIOG 18.6.8 

MIOG 1.2 

Section 288 

288-5.15 Search Warrant 


DIOG 18.7.1 

MIOG 1.2 

Section 288 

288-5.16 Voluntary Disclosure 


DIOG 18.6.8 

MI0GI.2 

Section 289 

289-13.3 Useof a Past or Present Prisoner-Witness in an ‘ 
Investigation (Formerly Part 2, 27-16,5) 

DIOG 115 

DIOG 18.6J1 and 18.6.2 

MIOG 1.2 

Section 308 

308-11 Evidence Response Team Mission 


generally, DIOG 12 for 
expert assistance. 

MIOG 1.2 

Section 308 

308-2 DEFINITION OF ERT CONCEPT 


Paragraph #4 only. 
DIOG 12 

MIOG 1.2 

Section 308 

308-3 PROPER TURKiNG 


Paragraph # 2 only. 
DIOG 12 

MIOG 1.2 

Section 308 

3084 ERT SUBCLASSIFICATIONS-ALPHA 
DESIGNATORS 


Paragraph #1 only. 
DIOG 12. See new 
classifications 

MIOG 1.2 

Section 319 

319-1 INTELLIGENCE PROGRAM 


generally, DIOG 5 

MIOG 1.2 

Section 319 

319*2 FIELD INTELLIGENCE GROUP (FIG) 
STRUCTURE AND FUNCTIONS 


generally, DIOG 5 

MIOG 1.2 

Section 319 

319-4 INTELLIGENCE COLLECTION 


Paragraphs #1 and 3 
generally, DIOG 5 

mFogi ]T~ 

Section 319 

319-5 COLLECTION MANAGEMENT 


generally, DIOG 5 

MIOG 11 

Section 2 

2-5 COMPLAINTS (RULE 3) 


DIOG 19 

^ MIOG II ^ 

Section 2 

2-5,1 Authorization of U.S, Attorney (USA) 


DIOG 19 

MIOG II 

Section 2 

2-5.3 State Prosecutions 


DIOG 3,12 

MIOG II 

Section^ 

2-5.4 Authority for Issuance of Warrant 


DIOG 19 

MIOG II 

Section 2 

2-5.5 Notification to Special Agent in Charge (SAC) 


DIOG 19 

" MIOG II 

Section 2 

2-6 WARRANT OF ARREST OR SUMMONS (RULE 4) 



MIOG II 

Section 2 

2-6.1 Forms of Warrant 


DIOG 19 

miogIi " 

Section 2 

2-6.2 Issuance of Warrant or Summons 


DIOG 19 

MIOG II 

Section 2 

2-6.3 Execution 


DIOG 19 

MIOGII 

Section 2 

2-7 PROCEEDINGS BEFORE THE MAGISTRATE (RULE 
5) 


DIOG 18 and 19 

MIOG II 

Section 2 

2-7.1 Initial Appearance 


DIOG 19 

MIOG 11 ^ 

Section 2 

2-9 GRAND JURY (RULE 6) ~ 

1 DIOG 119-119.1 

DIOG 18.5.9 and 1876.5 

MIOGII 

Section 2 

2-9.1 Purpose 


DIOG 18.5.9 and 18.6.5 

MIOGH 

Section 2 

2*9,2 Persons Present 


DIOG 18.5.9 and 18.6.5 

MIOG II 

Section 2 

2-9.3 Disclosure 


DIOG 18.5.9 and 18.6.5 

MIOGII 

Section 2 

2-9,4 Exceptions 

DIOG 11.9 -11.9.1 

DIOG 18.5.9 and 18.6.5 


Version Dated: 
October 15, 2011 


R-4 

UNCLASSIFIED - FOR OFFICIAL USE ONLY 

















UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 


I Part . 

Section 

Section Title 

DIOG 1 Supersession 

DIOG 2 Supersession 


Section 2 

2-9.5 Limitation of Use 


DIOG 18.5.9 and 18.6.5 

WllllS 

Section 2 

2-9,5,1 Matters Occurring Before the Grand Jury 

DIOG 11.9 -119.1 

DIOG 18.5.9 and.18,6;5 

MIOGII 

Section 2 

2-9.5.2 Physical Evidence and Statements 


DIOG 18.5.9 and 18.6.5 

MIOGII 

Section.2 

2-9.6 Documentation of Disclosures of Grand. Jury 
■Material 


DIOG 18:5.9 and 18.6.5 

MIOGII 

Section 2 

2-9.6.1 Documentation of Internal Disclosures of Grand 
Jury Material 


DIOG 18.5.9 and 18.6.5 

MIOGII 

Section 2 

2-9.7 Storageof Grand Jury Material 

DIOG 1 19 - 1 1 9,1 

DIOG 18.5.9 and 18.6.5 

MIOGII 

Section 2 

2-9.8 Requests for Subpoenas in Fugitive Investigations 

DIOG 11.9-11.9.1 

DIOG 18.5.9 and 18.6.5 

MIOGII 

Section 4 

84 Juveniles and Juvenile Delinquency Act 


DIOG 19 

MIOGII 

Section 4 

4-1 GENERAL STATEMENT 


DIOG 19 

MIOGII 

Section 4 

4-l.TPurpose of Act 


DIOG 19 

MIOGII 

Section 4 

4-2 SPECIFIC PROVISIONS OF THE ACT 


DIOG 19 

MIOGII 

Sectton4 

4-2.1 Definitions 


DIOG 19 

MIOGII 

Section 4 

4-2.2 Arrest Procedure 


DIOG 19 

MIOGII 

Section 4 

4-2.2, 1 Advice of. Rights 


DIOG 19 

MIOGII 

Section 4 

4-2.2.2 Notification of USA and Juveniles Parents 


DIOG 19 

MIOGII 

Section 4 

4-2.2,3 Fingerprinting and Photographing 


DIOG 19 

MIOGII 

Section 4 

4-2.2.4 Press Releases 


DIOG 19 

MIOGII 

Section 4 

4-2.2.5 Interviews of Juveniles 


DIOG 18 * 

MIOGII 

Section 4 

4-2.2.6 Initial Appearance Before Magistrate 


DIOG 19 

MIOG II 

Section 4 

4-2.3 Detention 


DIOG 19 

MIOGII 

Section 4 

4-2.4 Prosecution 


DIOG 19 

MIOGII 

Section 4 

4-2.5 Use of Juvenile Records 


.DIOG 19 

MIOGII ^ 

Section 7 

S7 Interviews 


DIOG 18.5.6 


Section 7 

^TTus^ * 



MIOG II 

Section 7 

7-2 THOROUGHNESS, PRECAUTIONS, TELEPHONIC 
AND USE OF INTERPRETERS 


DIOG 18.5.6 


Section 7 

7-2.1 Thoroughness and Precautions During Interviews 


DIOG 18.5.6 

MIOG II 

Section 7 

7-2.2 Telephone Interviews 


DIOG 18.5.6 

^MIOGII 

Section 7 

7-2.3 Use of Interpreters 


DIOGJ8,5.6 

MIOG II 

Section 7 

7-3 REQUIRING FBIHQ AUTHORITY 


DIOG 18.5.6 

MIOGII 

Section 7 

7-4'ONE VS TWO AGENT INTERVIEW OF SECURITY 
SUBJECT 


DIOG 18,6,6 

MIOGII 

Section 7 

7-5 EVALUATION OF AN INTERVIEW 


DIOG 1 8.5.6 

MIOGII 

Section 7 

7-6 iTERVlEWINGCOMPLAlNANTS AND SUBJECTS 
OF CRIMINAL 


DIOG 18.5.6 

MIOGII 

Section 7 

7-6.1 Interviews of Complainants 


DIOG 18.5.6 

MIOG n 

Section? 

7-6.2 Subjects of Criminal Investigations 


^ DIOG 18.5.6 

MIOG II 

Section 7 

7-7 DEVELOPMENT OF DEROGATORY INFORMATION 
DURING INTERVIEWS 


DIOG 18.5.6 

MIOGII 

Section 7 

7-8 IDENTIFICATION OF SUSPECTS 


DIOG 18 5.6 
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i : Part 

Section 

Section Title 

DIOG 1 Supersession 

DIOG 2 Supersession 

MIOG II 

Section 7 

7-9 INTERVIEWS INVOLVING OR RELATING TO 
COMPLAINTS 


DIOG 18.5.6 and 5 

MIOG 11 

Section 7 

7-9,1 Complaints Received atthe Field Office 


DIOG 18.5.6 and 5 

MIOG II 

Section 7 

7-9.2 Complaints in Person or by Telephone 


DIOG 18.5.6 and 5 

MIOG II 

Section 7 

7-9.3 Complaints By Letter 


DIOG 18.5.6 and 5 

MIOG II 

Section 7 

7-9.4 Complaints Critical of the FBI or Its Employees 


DIOG 18.5.6 and 5 

MIOG II 

Section 7 

7-9,5 Legal Requirements of the Privacy Act of 1 974 (Title 
5, USQ, Section 552a) 


DIOG 14 

MIOG II 

Section 9 

S9 Surveillances 


DIOG 18.5.8 

MIOG II 

Sectton9 

9-1 GENERAL GUIDELINES 


DIOG 18.5.8 

MIOG II 

Section 9 

9-1.1 Surveillance Restrictions 


DIOG 18 

MIOG II 

Section 9 

9-7,5 Surveillance Logs 


DIOG 3 

MIOG II 

Section 10 

S10 Records Available and Investigative Techniques 


DIOG 18 

MIOG ii 

Section 10 

104 INTRODUCTION 


DIOG 18^ 

MIOG II 

Section 10 

10-2 RECORDS AVAILABLE 


DIOG 18 

MIOG II 

Section 10 

10-3 INVESTIGATIVE TECHNIQUES 


in-part DIOG 18 

MIOG II 

Section 10 

10-6 MAIL COVERS 


DIOG 18.6.10 

MIOG II 

Section 10 

10-6.1 United States Postal Service (USPS) Regulations 


DIOG 18.6.10 

MIOG II 

Section 10 

10-6.2 Policy 

DIOG 11.3 

DIOG 18.6.10 

MIOG 11 

Section 10 

10-6.3 Requesting Approval 

DIOG 11.3 

DIOG 18.6.10 

MIOG II 

Section 10 

10-6.3.1 Fugitive or Criminal Cases 


DIOG 18.6.10 

MIOG II 

Section 10 

10-6.3,2 National Security Cases 


DIOG 18.6.10 

MIOG II 

Section 10 

10-7 STOP NOTICES 


DIOG 

^ MIOG II 

Section 10 

10*7,1 Definition 


DIOG 

MIOG II 

Section 10 

10-7.2 Placement of Stops 


DIOG 

, — — — 

Section 10 

10-7.3 Indexing Stops 


J DIOG^ 

MIOG II 

Section 10 

10-7.4 Removal of Stops 


DIOG 

MIOG II 

Section 10 

10-7.5 Types of Stops 


DIOG 

MIOG II 

Section 10 

10-7,5.1 Savings Bonds 


DIOG 

^miogiT” 

Section 10 

10-7.5.2 immigration and Naturalization Service (INS) 


DIOG 

MIOG 11 

Section 10 

10-7.5.3 Bureau of Prisons 


DIOG 

MIOG II 

Section 10 

10-8 STORED WIRE AND ELECTRONIC 
COMMUNICATIONS AND TRANSACTIONAL RECORDS 
ACCESS 


DIOG 18.6,8 

MIOG II 

Section 10 

10-8.1 Compelled Disclosure of the Contents of Stored 
Wire or Electronic Communications 

DIOG 11.12 

DIOG 18.6.8 

MIOG II 

Section 10 

10-8.2 Access to Transactional Information 


DIOG 18^8 

MIOG II 

Section 10 

10-8.3 Access to and Use of Electronic Communications 
Located on the Internet, E-Mail, and Bulletin Board 
Systems 


DIOG 18.6.8 

MIOG II 

Section 10 

10-8,3.1 Definitions 


DIOG 18.6.8 

MIOG II 

Section 10 

10-8.3.2 Interception of Electronic Communications 

DIOG 11.12 

DIOG 18.6.8 


Version Dated: 

October IS, 2011 UNCLASSIFIED - FOR OFFICIAL USE ONLY 































UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 


r Part ; . 

Section 

Section Title 1 

DIOG 1 Supersession 

DIOG 2 Supersession 


Section 10 

10*8.3.3 Undercover Use of the Internet 


DIOG 18.6.8 


Section 10 

10-8.4 Monitoring the Internet 


DIOG 18.6.8 

MIOG It 

Section 10 

10-9 ELECTRONIC SURVEILLANCE (ELSUR) 
PROCEDURES ANDREQUIREMENTS 

-DIOG 11.12 

DIOG 18,7.2, 

MIOG II 

Section 10 

10-9.1 Definitions 

DIOG 11.6.4,5 

DIOG 18.7.2 

MIOG II 

Section 10 , 

10-9.4 ELSUR Searching Procedures 

DIOG 11.6.6 

DIOG 18.7.2 

MIOG II 

Section 10 

10-9.10 Electronic Surveillance - Title III Criminal Matters 

DIOG 1112 

DIOG 18.7.2 

MIOGI! 

Section 10 

10-9.11 Emergency Provisions, TitieJII Criminal Matters 



MIOG 11 

Section 10 

10-9.11.1 Form 2 Report 


DIOG 18 

MIOG II 

Section 10 

10-9.11.2 Completion of Form 2 Report 


DIOG 18 

MIOG II 

Section 10 

10-9.11.3 Submissions of Form 2 Report to FBIHQ 


DIOG 18 

MIOG II 

Section 10 

1 0-9,1 1 .4 Supplemental Form 2 Reports 


DIOG 18 

MIOG II 

Section 10 

10-9.12 ELSUR Indexing in Title ill Criminal Matters 


DIOG 18 

MIOG II 

Section 10 

10-9.13 Marking of Recordings for identification 


DIOG 18 

MIOG II 

Section 10 

10-9.14 Loan of Electronic Surveillance Equipment to 
State and Local Law Enforcement Agencies 
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Section 3 

03-8: (U) Operational Support to the Intelligence 
Community 

DIOG 12.5/DIOG 14.5 

DIOG 12 
CPD #0170D 

NFIPM 

Section 3 

03-9: (U) Operational Technology Division (OTD) 
Technical Assistance 


NFIPM 

nfipm" 

Section 3 
Sections 

Section 3-10 (U) Operational Technology Division 
(OTD)Technical Assistance Support to the Intelligence 
Community 

0341; (U) UnconsentedPhysical Searches 

DIOG 11,13 

DIOG 12 (generally) 
* DIOG 18.7 j 

NFIPM 

nf™ 

NFIPM 

Section 3 

03-12: (U) Tax Return information 


Appendix N- Tax Return 
Info 

Section 3 
Section 3 

03-13: (U) Searches of Mail Without Consent 

03-14: (U) Unconsented Physical Search Minimization, 
Logs and Indexing 

— ' — 

DIOG 18.7.1 

DIOG 18.7.1 and SMP 
PG 

NFIPM 

NFIPM 

Section 4 
Section 5 

04-1: (U) The Domain Program 
05-2: (U) Countries on the Current National Security List 

1 - 

DIOG 5, type 4 
assessments generally, 

Appendix G 

Version Dated: R-14 


October IS. 2011 UNCLASSIFIED - FOR OFFICIAL USE ONLY 


b7E 



UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 


1 Part . 

Section 

Section Title 

! DIOG 1 Supersession 

DIOG 2 Supersession 

NFIPM 

Sections 

05-23; (U) Alpha Designations 


CPD #001 5D. SeeRPO 
web-page. 

NFIPM 

Section 6 

06-12: (U) Alpha Designations 


CPD #0015D. SeeRPO 
web-page. 

NFIPM' 

Section 8 

08-11: (U) Alpha Designations 


CPD #0QJ5D; SeeRPO 
webrpage. 

NFIPM 

Section 9 

09-8: (U) Alpha Designations 


CPD #001 5D. SeeRPO 
web-page. 

NFIPM" 

Section 11 

114; (U) Alpha Designations 


CPD #0015D. SeeRPO 
web-page. 

NFIPM 

Section 12 

124: (U) Alpha Designations 


CPD#0015D. SeeRPO 
web-page. 

NFIPM 

Section 13 

1 34: (U) Alpha Designations 


CPD #0015D. SeeRPO 
webpage. 

NFIPM 

Section 14 

144: (U) Alpha Designations 


CPD #001 5D. See RPO 
web-page. 

NFfPM 

Section 15 

154: (U) Alpha Designations 


CPD #0015D. See RPO 
web-page. 

NFIPM 

Section 16 

16-13: (U) Alpha Designations 


CPD #0015D. SeeRPO 
web-page. 

NFIPM 

Section 18 

18-3: (U) Issue Threat Preliminary Investigations 


DIOG 6 

NFIPM 

Section 18 

184: (U) Issue Threat Full Investigations 


DIOG 7 

NFIPM 

Section 18 

18-6; (U) Issue Threat File Numbers 


CPD #0015D. SeeRPO 
web-page. 

NFIPM 

Section 19 

19-3: (U) Procedural Requirements in International 
Terrorism Investigations 


DIOG 5, 6, 7,8 

mm v ~ 

Section 19 

194: (U) Closing international Terrorism Investigations 

"diogw ~ 

" bioGle^T 

NFIPM 

Section 19 

19-11: (U) The Behavioral Analysis Program 


DIOG 19.4 

NFIPM 

Section 19: 

19-13: (U) Alpha Designations 


^PD^0?5D.^io^ 

web-paga 

NFIPM 

Section 20 

20-9 (U) The Behavioral Analysis Program 


DIOG 19.4 

NFIPM 

Section 20 

20-10 (U) Alpha Designations 


”cPD#0015D. SeeRPO 
web-page. 

NFIPM 

Section 21 

21-6: (U) Alpha Designations 


CPD #0015D. SeeRPO 
web-page. 

NFIPM 

Section 22 

22-2: (U) Alpha Designations 


CPD #001 5D. SeeRPO 
web-page. 

NFIPM 

Section 27 

Confidential Human Sources Manual 


CHSPM 

' NFIPM 

Section 27 

Confidential Human Source Validation Standards Manual : 


’ CSHVSM 

NFIPM 

Section 28 

Section : 28 (U) Undercover Operations (4) 


DIOG and NSUCOPG 

NFIPM 

Section 28 

28-1: (U)UC Operations 

DIOG 11.12 

DIOG 18,6.3 and 
NSUCOPG 

NFIPM 

Section 28 

28-2: (U) Group 1 

DIOG 11.12 

DIOG 18.6.3 and 
NSUCOPG 

NFIPM 

Section 28 

28-3: (U) Group II 

DIOG41.12 

DIOG 18.6.3 and 
NSUCOPG 
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Part 

Section 

Section Title 

: DIOG 1 Supersession j 

NFIPM 

Section 28 

284: (U) UC Administrative Matters 

DIOG 11.12 

NFIPM 

Section 30 

3041: (U) The Behavioral Analysis Program 


MAOPI 

0-1 

Authority of the Director 


MAOPI 

21-7 (6) 

Monitohng f documenting:andteviewing 


MAOP II 

1-1 

SAC and ASAC Supervisory Responsibility 


MAOPI! 

1-1.4 (#1) 

Supervision of Cases 


MAOP II 

1-1 .4 (#2 and 
#3 a-f) 

Supervisory File Reviews 


MAOP II 

1-15.1 

Official Channels 


MAOP II 

1-3.5 

Designation of Senior Resident Agent and Alternate 


MAOP II 

1-3.6 

Reporting to HQ City 


MAOP II 

1-3.13..2 (1) 

Supervision of Investigations 


MAOPI! 

1-3.13:3 (all) 

Case Reviews 


MAOP II 

2-3 

Indexing 


* ™MAOP if ~ 

2-3.1 

Purpose 


MAOP II 

2-4 

Management of Files » 


" MAOP?”’ 

2-4.1 ^ 

Investigative Files 


MAOP II 

2-4.1. 1 

Serializing 


MAOP II 

24.1.2 

Zero Files 


MAOP II 

24.1.3 

Double Zero Files 


MAOP II 

^2 -4.1.4 

Dead Files - No Pending Investigation 


MAOP II 

24.1.5 

Control Files 


MAOP II 

24.2 

Administrative Files 


MAOP II 

24.2.1 

Noninvestigative Files 



DIOG 2 Supersession 


DIOG 18.6.3 and 
NSUCOPG 

DIOG 3.2.1 

Paragraphs #2 and #5. 
DIOG3.4.C and 
Succession and 
delegation policy 

' Paragraph #1 -D1QG 14 

Paragraph #2 and #3 
(a-f) - # 2 Supervisory 
File reviews and #3 
PSAs. DIOG3.4.D 


Paragraph 4 ® b only ~ 
superseded by CPD 
0152D-FBI Policy Cycle 
Directive. 


Second and third 
sentences only -DIOG 

3.4.C and succession 
and delegation policy 
? 

First and second 
sentence -file reviews 
every 90 days; DIOG 

3.4.D 

Paragraph (1) - DIOG 

3.4.C and succession 
and delegation policy 

— 

All (paragraphs 1-6) - 
DIOG 3.4.D 

DIOG 14 

DIOG Appendix J 

DIOG 14 

DIOGlT 

DIOG 14 

Paragraph (2)only. 
_ JDIOG14_ 

DIOG 14 

DIOG 14~^ 

Paragraph (1) first four 
sentences only. DIOG 
J4 

DIOG 14 
DIOG 14 ^ 
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f Part 

Section 

Section Title 

I DIOG 1 Supersession 

1 DIOG 2 Supersession 

MAOPli 

24,3.6 

Consolidation of Files 


DIOG 14 

MAOP II 

24.3.7 

Reclassification of Files 


DIOG 14 


2-5 

Case Management - Field Offices 


DIOG 14 

MAOP II 

2-5.1 

Opening Cases 


Paragraphs 1, 2, 3,4 
(initial paragraph only 
before sub-letters), 4d, 
4e, 4f, and 5 (first 
sentence only). DIOG 
various sections 

MAOP II 

2-5,11 

Leads 


Paragraph (2), delete 
"Discretionary Action 1 
: leads in first sentence 
only; and delete 2b. 
DIOG 14 

MAOP 11 

2-5.2 

Status of Cases 


DIOG 14 

MAOPjl ' 

2-5,2;1 

Pending Case 


DIOG 14 

MAOP II 

2-5.2. 2 

Pending Inactive 


Paragraphs 2, 2a-c, and 
3 only. DIOG 14 

MAOP II 

2~5,2,3 

Referred Upon Completion to the Office of Origin (RUG) 


DIOG 14 

MAOP II 

2-5.24 

Closed 


DIOG 6.11, 7.11, 8.8, 
9.12 

MAOP II 

2-5;2,5 

Unaddressed Work 


DIOG 14' 

MAOP II 

3-1 

FBI Classifications/Sub-classifications and Program 
Groupings 


CPD 0015D. RPO/RAU 
is now responsible for 
this area by EC 66F-HQ- 
1079817 serial 705. Link 
to RPO web-site. 
Supersede section 3.1 
and all subparts. 

MAOP II 

3-1.1 

FBI Classifications and Subdivided Classifications, 


only 62D; 62E replaced 
with new 343 
classification. 163 M-U 
classification added, 
DIOG 12 

MAOP II 

3-3 (3c) 

Task Force Officers (defined) 


DIOG 3.3.2 

MAOP II 

3-3,2 (1) 

Special TURK Recording Procedures (1) Major Cases 


. #1a-g. DIOG Appendix 
J-Major Cases 

MAOP II 

34.5 (9 a-g) 

Case Count Information (# 9 re: closings) 


Paragraph # 9 a-g was 
supersede by DIOG 
6.11; 7.11; 8.8; and 9.12. 

MAOP II 

34.8 

Reclassifying Cases and Error Correction 


DIOG 6. 1 1C; 7~1 1 C; 
8.8.C; and 9.1 2. C 
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1 Part 

Section 

Section Title 

I DiOG 1 Supersession | 

DIOG 2 Supersession 

MAOP II 

34.8 

Criminal Preliminary Inquires 

' 

Paragraph #1 only. 
DIOG Section 6.7 -PIS 
are authorized for 6 
months; extension 
authorized for 6 
additional months by 
SAC; and FBIHQSC. 

MAORI! 

34,10(1) 

Spin-off Cases (paragraph #1 - defined) 


DIOG 14 

MAOP II 

34.10(2) 

Spin-off Cases (paragraph #2 - who can authorize) 


DIOG 5, 6, 7, 8, and 9. 

MAOP II 

34.11(1) 

Control Files (Paragraph #1 - defined) 


superseded paragraph. 
#1. defined in DIOG 14 

MAOP II 

34.11 (2) 

Control Files (Paragraph #2 - leads) 


superseded paragraph # 
2, DIOG 14 

MAOP II ; 

. 34.11 (3) 

Control Files (paragraph #3, third sentence only) 


delete third sentence 
only, DIOG 14 

MAOP II 

9 

Dissemination of Information 


DIOG 14.3 (generally) 

MAOP II 

9-3 

Information to Be Disseminated 


DIOG 14.3, 14.4, 14.5 
and-14.6 

MAOP II 

9-3 

(paragraph 1) 



DIOG 14.3.A and B 

MAOP II 

9-3 

(paragraph 2) 

AG Memo 9/21/2001 - "Disseminating Information to 
Enhance: Public Safety and National Security." 


DIOG 14 

MAOP II 

9-3 

(paragraph 3) 



DIOG 14.3.A.5 

MAOPil 

93/1 

Dissemination to State and Local. Criminal Justice and 
Noncriminal Justice Agencies 


DIOG 14.3:A,3 

MAOP II 

9-3.1. 1 

Dissemination to State and Local Criminal Justice 
Agencies 


DIOG 14.3 

MAOPil ' 

9-3.2 

Information Totally Within Jurisdiction of Other Federal 
Agencies 


DIOG 14.4.B 

MAOP II 

9-3.3 

Information within FBI Jurisdiction and of interest to 
another Federal Agency 


DIOG 3.4.E 

MAOPil 


Interested Agency Outside a Field Office Territory 


DIOG1Z4 

MAOP II 

9-34.3 

Interested Agency Within a Field Office's Territory 


DIOG 12.4 ~ 

MAOPil 


Reporting Information Furnished 


DIOG 12.4 and 12.5. 

MAOP II 

9-3.5 

Method of Dissemination to Outside Agencies 


DIOG 124 and 12.5 

MAOP II 

93.5.3 

Oral Dissemination to Outside Agencies 


^ DIOG 12 and 14/* 
generally 

MAOP II 

93.5.4 

Accounting of Dissemination 


DIOG 12.4 and 12.5 

MAOPil 

94.2,6 

Investigative Activity in Congressional Offices 


Interview or CHS -DiOG 
■18,5.6 and CHSPM 

MAOP II 

94.2.9 

Dissemination to the White House Complex 


Interview or CHS - 
DIOG 18.5.6. Paragraph 
(2) Superseded by AGG- 
Dom, DIOG and AG 
Memo WH Contacts 

MAOPil 



9-6 

Major Cases - Dissemination of Information 


DIOGAppendixK- 

MajorCases 
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MAOP II 

9-7 

Threat to Life - Dissemination of Information 


DIOG 14 

MAORI! 

9-7.1 

information Concerning Threats Against the President and 
Other Designated Officials 


DIOG' 14 

MAOP II 

9-7.2 

Information Concerning Threats, Possible Violence or 
Demonstrations Against Foreign Establishments or 
Officials in the US 


DIOG 14 

MAOP II 

9-7.2.1 

Information Received Through' other Than Technical 
■ Surveillance 


DIOG 14' 

MAOP II 

9-7.2.2 

Information Received Through Technical Surveillance 


DIOG 14 

MAOP 11 

. 9-7.2,3 

Miscellaneous 


DIOG. 14 

MAOP II 

9-8 

Replies to Foreign Police and Intelligence Contacts 


DIOG 14 

-MAOP 11 

9-8,1 

Letterhead Memoranda Prepared by Bureau’s Foreign : 
Offices 


DIOG 14 

MAOP 11 

9-8.2 

Dissemination of Classified Information 


DIOG 12 and 14 

MAOP |j 

9-9 

Dissemination of Grand Jury Material 


DIOG 18.6.5 

MAOP 11 

9-10 

Dissemination of Title XI, Right to Financial Privacy Act of 
1978 


DIOG Appendix O - 
RFPA 

MAOP II 

9-13 

Dissemination By Reid Intelligence Groups 


DIOG 14 ' 

MAOP II 

10-9 

General Rules Regarding Recording and Notification of 
Investigations 


Supersede Paragraphs # 
la-c; 2a-c; 5; 6; 7; 9; 
lOa-c; 11-16; and 23-24. 
DIOG, various sections. 

MAOP II 

10-10.9:1 

Approval by individuals Delegated to Act on Behalf of 
Higher Bureau Officials 


DIOG 3.4.G 

MAOP II 

10-12 

Notes made During Investigations - Interviews 


DIOG 3 and 14 

MAOP?’’” 


FileRevrew 


DIOG 3.44.1 

MAOP II 

2-5.1. 4 (a) 
and (b) 

Sub-file 


Appendix J 15 

MAOPI! 

24.1.5(4) 



Appendix J 14,4 

MAOP II 

10-16.2 

Office of Origin 


DIOG 14 

MAOP Pt 

21-7(6) 

Monitoring, Documenting and Reviewing 


Remove second to last 
; and last sentence only. 
Remove citatlon-to 
MAOPattheend.of 
Paragraph #6 and add 
citation "SeeDIOG 
J.i£_ 

NA 

EC 

1 1 


34.D 

m 

EC 

To Provide Guidance on Least intrusive Techniques in 
National Security an Criminal Investiaations - OGC EC 
1 ‘ ‘ 112/20/2007 

DIOG 4, 4.1, 11.1.1 

DIOG 4,4.4,18.1 .1-2 

N/A 

EC 

Mail Cover Cites - EC dated 12/22/2004 

DIOG 11.3 

DIOG 18.6.10 

MIOGH 

10-10 17v1 a 
and form 

FD-670, Consensual Monitoring - Telephone Checklist 

DIOG 115 

DIOG 18.6.1 

N/A 

form 

FD-671, Consensual Monitoring - Non-telephone 
Checklist 

DIOG 11.5 

DIOG 18.6.1 

N/A ‘ 

EC 

-Electronic Surveillance - EC dated 1 2/20/2007 

DIOG 1112 

DIOG 18.7.2-3 


b7E 

b7E 
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N/A 

EC 

Civil Liberties and Privacy 
EC issued by OGC dated 3/19/2004 


DIOG 4.1, 6.3, 8.3, 9.3, 
15.3 

N/A 

EC 

Civil Liberties and Privacy 
EC Issued by, OGC dated 9/8/2005 


DIOG 4.1, 7.3 

N/A 

EC 

Least Intrusive Techniques in National Security and 
Criminal Investigations - EC issued by OGC on 
12/20/2007, file numbel 1 


DIOG 4, 4.4,18.1.1-2 

N/A 

EC 

Protection of First Amendment Rights 
EC issued by OGC dated 3/19/2004 
EC issued by CTD dated 09/01/2004 
EQ issued, by OGCdated 12/05/2003 


DIOG 4.2. 

N/A 

EC 

FBI National Collection Requirements 
EC issued by DO dated 01/30/2003 


DIOG 5.11 

N/A 

EC 

Retention and Dissemination of Privacy Act Records 
EC issued by OGC dated 03/19/2004 


DIOG 5,13 

N/A 

EC 

Authorized Investigative Methods in Assessments 
ECs issued by OGC dated 03/19/2004 and 9/18/2005 


DIOG 18.3, 18.5 

N/A 

EC 

Authorized Investigative Methods in Full Investigations 
EC issued by, OGC dated 10/29/2003 


DIOG 18.3, 18.7 

N/A 

EC 

Federal Grand Jury Subpoena 
EC issued by OGC dated 06/01/2007 


DIOG 18.5.9, 18.6.5 

N/A 

EC 

Administrative Subpoena 
EC issued by CID dated 06/06/2001 


DIOG 18.6.4 

N/A 

EC 

Voluntary Disclosure of Non-Content Customer Records 


DIOG 18.6.8 

N/A 

EC 

Definition of investigative Method. 

EC issued by OGC dated 10/14/2003 _ 


DtOG 18;6;9:3 

N/A 

EC 

FISA Review Board for RISA Renewals 
EC issued by Director's Office dated 02/06/2006 


DIOG 18.7.3.1.5.3 

N/A 

EC 

Assistance to Other Agencies 
EC Issued by OGC dated 12/5/2003 


DtOG 12 

N/A 

EC 

Emergency Disclosure Provision for Information from 
Service Providers Under 18 U.S.C. Section 2702fb1 - EC 


DIOG 18 ' 

issued bv OGC 08/25/2005. file numb d 1 




anc 

I 









LHSA 

7-4,1 (7) 

Consolidated Legal Handbook for Special Agents Section 
74,1(7) into Interview Section of DIOG 


DIOG 18 

N/A 

EC 

Electronic Recording of Confessions and Witness 
Interviews -EC issued bv OGC on 03/23/2006, file number 


DIOG 18 


mcl land EC dated 




//lb/11, tile 

i 









N/A 

EC 

FBI Mandated Fife Review Process - EC issued bv INSD 
on 07/07/2010, file numberf | 


DIOG 3 




□ 



N/A 

EC 

Procedural and Operational Issuance - Guidance for 
Legislative Corruption - EC issued by CID on 08/08/2006, 


DIOG 18 



file number] | 



N/A 

CRD 0227 

Designation of an Acting Official to Issue National Secunty 
Letters 


DIOG 18.6.6.3 
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b7E 


b7E 
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N/A 

CPN0382N 

Notice, National Security Mail Cover Request Approval 
Authority 


DIOG 18.6.10.5 

NA 

EC/SAC 

Memo 

March 5, 2003 Director’s Memorandum to Alf-.Specjal 
Agents in Charge Re: Pre4itte lll Electronic Surveillance 
(ELSUR1 Search Policv; andthe ADnT14. 2008. All Field 
Offices EC from RMD. Case lDij | 


Appendix H 

N/A 

RAP Tool 
User Guide 
vl.1 

Resource Allocation Planning (RAP) Tool, User Guide 
vl.1 - delete definition of task force officer and task force 
member on pagel 


DIOG 3 
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APPENDIX S: (U) LISTS OF INVESTIGATIVE METHODS 

S. 1 Investigative Methods Listed by Name (Alphabetized) 

(U) Administrative subpoenas. (Section 18.6.4) 

(U) CHS use and recruitment. (Section 18.5.5) 

(U) Closed-circuit television/video surveillance, direction finders, and other monitoring devices. 
(Section 18.6.3) 

(U) Consensual monitoring of communications, including electronic communications. (Section 
18.6.1) 

(U) Electronic surveillance - FISA and FISA Title VII (acquisition of foreign intelligence 
information). (Section 18.7.3) 

(U) Electronic surveillance - Title III. (Section 18.7.2) 

(U) FISA Order for business records. (Section 18.6.7) 

(U) Grand jury subpoenas. (Section 18.6.5) 

(U) Grand jury subpoenas - only for telephone or electronic mail subscriber information in Type 
1 & 2 Assessments. (Section 18.5.9) 

(U) Information voluntarily provided by governmental or private entities. (Section 18.5.7) 

(U) Intercepting the communications of a computer trespasser. (Section 1 8.6.2) 

(U) Interview or request information from the public or private entities. (Section 18.5.6) 

(U) Mail covers. (Section 18.6.10) 

(U) National Security Letters. (Section 18.6.6) 

(U) On-line services and resources. (Section 18.5.4) 

(U) Pen registers and trap/trace devices. (Section 18.6.9) 

(U) Physical Surveillance (not requiring a court order). (Section 18.5.8) 

(U) Polygraph examinations. (Section 18.6.11) 

(U) Public information. (Section 18.5.1) 

(U) Records or information - FBI and DOJ. (Section 18.5.2) 

(U) Records or information - Other federal, state, local, tribal, or foreign government agency. 
tSection 18.5.3) 

(U) Searches - with a warrant or court order. (Section 18.7.1) 
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(U) Stored wire and electronic communications and transactional records. (Section 18.6. 81 

(U) Trash Covers (Searches that do not require a warrant or court order). (Section 18.6.121 

(U) Undercover Operations (Section 18.6.13) 

S.2 Investigative Methods Listed by order in DIO G Section 18 

18.5.1 (U) Public information 

18.5.2 (U) Records or information - FBI and DOJ. 

18.5.3 (U) Records or information - Other federal, state, local, tribal, or foreign government 
agency. 

18.5.4 (XT) On-line services and resources. 

18.5.5 (U) CHS use and recruitment. 

18.5.6 (ID Interview or request information from the public or private entities. 

18.5.7 (U) Information voluntarily provided by governmental or private entities. 

18.5.8 (ID Physical Surveillance (not requiring a court order). 

18.5.9 (U) Grand jury subpoenas - only for telephone or electronic mail subscriber information. 

18.6.1 (U) Consensual monitoring of communications, including electronic communications. 

18.6.2 (TJ1 Intercepting the communications of a computer trespasser. 

18.6.3 (U) Closed-circuit television/video surveillance, direction finders, and other monitoring 
devices. 

18.6.4 (U) Administrative subpoenas. 

18.6.5 (U) Grand jury subpoenas. 

18.6.6 (U) National Security Letters. 

18.6.7 ('ll) FISA Order for business records. 

18.6.8 (U) Stored wire and electronic communications and transactional records. 

1 8.6.9 (U) Pen registers and trap/trace devices. 

18.6.10 (U) Mail covers. 

18.6.1 1 (U) Polygraph examinations. 

18.6.12 (U) Trash Covers (Searches that do not require a warrant or court order). 

18.6.13 (U) Undercover operations. 
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18.7.1 (U) Searches - with a warrant or court order. 

18.7.2 (U) Electronic surveillance - Title III 

18.7.3 (U) Electronic surveillance - FISA and FISA Title VII (acquisition of foreign intelligence 
information). 
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APPENDIX G: (U) CLASSIFIED PROVISIONS 

(U) This Part supplements the unclassified provisions of the AGG-Dom and DIOG. 


(U) Table of Contents 
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G.2 (U) Circumstances Warranting a Preliminary or Full Investigation 3 
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G.4 ^K//NF) Attorney General Threat Country List 
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G.7 (U) Sensitive Investigative Matters (SIM) •••••• 
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G.9 (U) Notice Requirements for the DOJ National Security Division (NSD) . 
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G.12 (U) National Security Letters for Telephone Toll Records of Members of the News Media 
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G. 1 (U) Limitation on Certain Searches 

G.1.1 (U) Classified AGG-Dom Provision 


G.1.2 (U) DIOG Classified Provision 

(U) Refer to the Domestic Investigations and Operations Guide (DIOG) Section 18.7.1 for 
procedures to obtain a FISA search warrant. 
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(U) Circumstances Warranting a Preliminary or Full Investigation 


G.2.1 (U) Classified AGG-Dom Provision 


G.2. 2 (U) DIOG Classified Provision 


(U) The provisions of DIOG Sections 6 (Preliminary Investigations) or 7 (Full Investigations) 
with regard to the purpose, approval and notification requirements apply fully to investigations 
predicated under this provision. 
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(U) Determination of United States Person (USPER) Status 
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G.3 

G.3.1 (U) Classified AGG-Dom Provision 
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G.6 (U) Consensual Monitoring 

G.6.1 (U) DIOG Classified Provision 
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(U) Sensitive Investigative Matters (SIM) 


G. 7.1 (U) DIOG Classified Provision 


G.7.1.1 (U / /FOUO) Member of the News Media or a News Organization 

(U//FOUO) DIOG Section 10. 1 .2.2.5 defines a member of the news media or a news 
organization as a SIM. It further defines a member of the news media or a news organization 
as: 


bl 


(U//FOUO) " News media ” includes persons and organizations that gather , report or 
publish news , whether through traditional means (e.g., newspapers , radio , magazines , 
news service) or the on-line or wireless equivalent A “ member of the media ” /s a person 
who gathers , reports , or publishes news through the news media. 

(U//FOUO) The term " News Media' also includes cm entity organized and operated for 
the purpose of gathering, reporting or publishing news . , The definition does not , however, 
include a person or entity who posts information or opinion on the Internet in blogs, chat 
rooms or social networking sites , such as YouTube , Facebook, or My Space , unless that 
person or entity falls within the definition of a member of the media or a news 
organization under the other provisions within this section (e.g., a national news reporter 
who posts on his/her personal blog). 

(U//FOUO) Examples of news media entities include television or radio stations 
broadcasting to the public at large and publishers of newspapers or periodicals that 
make their products available to the public at large in print form or through an Internet 
distribution. A freelance journalist may be considered to work for a news organization if 
the journalist has a contract with the news entity or has a history of publishing content. 
Publishing a newsletter or operating a website does not by itself qualify an individual as 
a member of the news media. Businesses , law firms , and trade associations offer 
newsletters or have websites ; these are not considered news media. As the term is used in 
the DIOG, “ news media ” is not intended to include persons and entities that simply make 
information available. Instead, it is intended to apply to a person or entity that gathers 
information of potential interest to a segment of the general public, uses editorial skills to 
turn raw materials into a distinct work, and distributes that work to an audience, as a 
journalism professional If there is doubt about whether a particular person or entity 
should be considered part of the '‘news media, ” the doubt should be resolved in favor of 
cons id ering the person or entity to be the " news media. " 
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G.7,1.2 (U) Academic Nexus * 

(U//FOUO) DIOG Section 10.1.2.2.6 states: 

(U//FOUO) Academic Nexus— As a matter of FBI policy, an investigative activity having 
an “academic nexus " is a SIM if: 

(i) (U//FOUO) the investigative activity involves matters related to the 
responsibilities of an administrator or faculty member employed by any college 
or university that is located inside the United States, provided the matter under 
Assessment/investigation is related to the individual's position at the institution; 
or 

(ii) (U//FOUO) the matter \ involves any student association recognized and 
approved by a college or university at which the student association at issue is 
located, and the college or university is located inside the United States. 

(U//FOUO) The sensitivity related to an academic institution arises from the American 
tradition of “academic freedom” (Le., an atmosphere in which students and faculty are 
free to express unorthodox ideas and views and to challenge conventional thought 
without fear of repercussion). Academic freedom does not mean , however, that academic 
institutions are off limits to FBI investigators in pursuit of information or individuals of 
legiti mate investigative interest 

G.7.1.2.1 
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G.8 (U) Data Analysis 

G.8.1 (U) DIOG Classified Provision 

(M/NF) Data analysis conducted by the FBIHQ Count erintelligence Division| 

~| must be coordinated w ith the FBIHQ 

Office of the General Counsel, Privacy and Civil Liberties Unit and the National Security Law 
Branch regarding the proper documentation and disposition of such analysis. 
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G.9 (U) Notice Requirements for the DOJ National Security Division (NSD) 

G. 9. 1 (U) DIOG Classified Provision 

AIM Sensitive Investigative Matter: For a national security investigation or “assistance to 
other agencies” involving a sensitive investigative matter that is classified “Secret,” the 
appropriate FBIHQ section must send electronic notice to DOJ NSD at 

For a national security investigation or “assistance to other 


agencies” involving a sensitive investigative matter that is classified “Top Secret,” the 
appropriate FBIHQ section must send electronic notice to DOJ NSD at 


lNotices to DOJ NSD must contain only the Letterhead Memorandum 


(LHM); the electronic communication (EC) should not be sent to DOJ NSD. 

National Security Full Investigation of a United States Person (USPER): For a Full 
Investigation of a USPER relating to a threat to the national security (this reporting 
requirement does not apply to full positive foreign intelligence investigations) that i s classifi ed 
‘Secret,” the appropriate FBI HQ section must send electronic notice to DOJ NSD at 


For a Full Investigation of a USPER relating to a threat to the 
national secuntv that is classified “Top Secret,” the appropriate FBIHQ section must send 

f 


electronic notice to DOJ NSD af 


Notices to DOJ NSD must only 

contain the LHM; the EC should not be sent to DO J NiSO. 

C) ^ Assistance to a Foreign Agency: When FBIHQ approval is required to provide assistance 
to a foreign agency in a matter involving a threat to the national security, notice must be 
provided to DOJ NSD. For a foreign assistance matter that is classified “Secret,” the 
appropriate FBIHQ division approving the in vestigative method must send electronic notice to 
DOJ NSD at | For a foreign assistance matter that is classified 

“Top Secret/ 7 the appropriate F BIHQ division approving th e investigative method must send 

lNotices to DOJ NSD must only 


electronic notice to DOJ NSD at 

contain the LHM; the EC should not be sent to DOJ NSD 
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G.10.1 (U) DIOG Classified Provision 

(U) Note : The I 

| - see Appendix G.10.1.3.A below) conducted under DIOG Section 5. 

G.IO. 1.1 (U) Definition 
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G.ll.l (U) DIOG Classified Provision 

Procedures for conducting a | _ 


G.ll. 1.1 ^Central Intelligence Agency Headquarters (CIAHQ) 


G.ll. 1.2 National Security Agency Headquarters (NSAHQ) 
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G. 1 2 (U) National Security Letters for Telephone T oll Records of Members 
of the News Media or News Organizations 

j^//NF) Members of news media or news organizations: An investigation of members of the 
news media or news organizations is a sensitive investigative matter (SIM). See DIOG Section 

10 and Appendix G-7 for Sensitive Investigative Matters. A member of the new smedianr a * 

nf>wc nrerai-iDafinn is rlefine H in DIQfr Seotinn 10 17? 5 and AnnondlX G 7 1 1 / 


bl 


m 


(U) Department of Justice policy with regard to the issuance of subpoenas for telephone toll 
records of members of the news media is found at 28 C.F.R. § 50. 10. The regulation concerns 
only grand jury subpoenas, not National Security Letters (NSLs) or administrative subpoenas. 
(The regulation requires Attorney General approval prior to the issuance of a grand jury 
subpoena for telephone toll records of a member of the news media, and when such a subpoena 
is issued, notice must be given to the news media member either before or soon after such 
records are obtained.) The following approval requirements and specific procedures apply for the 
issuance of an NSL for telephone toll records of members of the news media or news 
organizations. 

(U//FOUO) Approval requ irements: In addition to the approval requirements for NSLs set out 
in DIOG Section 18.6.6.3.3.1 I 


A) (U//FQUof 


B) (U//FOUO)[ 



C) m//FOIIOtf 


D) |S^NF) If the NSL is seeking tel ephone toll records of an ind ividual who is a member of the 


news media or news orofmiznHortl 


/mere are no additional approval requirements" 
other than those set out m D.1UU Section 1 8.6.63.3,1 ” " 
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(\ It Snecific Procedures: The procedures for creating an NSLj 


1 1 

S lure the same as set out in DIOG Section 18.6.6.3JJ 1 
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G.13 (U) Other Investigative Resources 
G.13.1 (U) DIOG Classified Provision 


G.13.1.1 (U/ /FOUO) Sensitive Technical Equipment 


:al Equipment” (STE) includes | 


ISTE is a) 


any techno log j 


\) tecnnology that 

has been jointly developed witn or developed by another u. Sr Government (USG) agency 
such that the FBI is not the sole owner and on which originator controls have been placed. 
The Assistant Director of the OTD after consultation with the relevant operational division is 
authorized to determine whether particular equipment is (or is not) STE. 
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